0

I have been using snoopy in my testing environment , i am facing issues with snoopy logging unnecessary logs are also logged in snoopy.log i have tried multiple filtering patterns but nothing worked out below are the logs sample and my snoopy config

pid:17746 uid:0 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/su]: su test
[pid:17747 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/bin/bash]: bash
**[pid:17749 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -gn
[pid:17751 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -un
[pid:17752 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/libexec/grepconf.sh]: /usr/libexec/grepconf.sh -c
[pid:17753 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/grep]: grep -qsi ^COLOR.none /etc/GREP_COLORS
[pid:17755 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/tty]: /usr/bin/tty -s
[pid:17756 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/tput]: /usr/bin/tput colors
[pid:17758 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/dircolors]: /usr/bin/dircolors --sh /etc/DIR_COLORS.256color
[pid:17759 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/grep]: /usr/bin/grep -qi ^COLOR.none /etc/DIR_COLORS.256color
[pid:17761 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
[pid:17817 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/mkdir]: mkdir test
[pid:17873 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/mkdir]: mkdir test1
[pid:17874 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/less]: less /alog/snoopy.log
[pid:17875 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/bin/bash]: /bin/bash -c /usr/bin/lesspipe.sh /alog/snoopy.log
[pid:17875 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/lesspipe.sh]: /usr/bin/lesspipe.sh /alog/snoopy.log

===========================Config==================================

[snoopy]
message_format = "datetime=%{datetime} username=%{username} tty=%{tty} cmdline=%{cmdline}"
filter_chain = "only_tty;exclude_spawns_of:cron,sh"
output = file:/alog/snoopy.log

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.