0

I have been using snoopy in my testing environment , i am facing issues with snoopy logging unnecessary logs are also logged in snoopy.log i have tried multiple filtering patterns but nothing worked out below are the logs sample and my snoopy config

pid:17746 uid:0 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/su]: su test
[pid:17747 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/bin/bash]: bash
**[pid:17749 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -gn
[pid:17751 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -un
[pid:17752 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/libexec/grepconf.sh]: /usr/libexec/grepconf.sh -c
[pid:17753 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/grep]: grep -qsi ^COLOR.none /etc/GREP_COLORS
[pid:17755 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/tty]: /usr/bin/tty -s
[pid:17756 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/tput]: /usr/bin/tput colors
[pid:17758 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/dircolors]: /usr/bin/dircolors --sh /etc/DIR_COLORS.256color
[pid:17759 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/grep]: /usr/bin/grep -qi ^COLOR.none /etc/DIR_COLORS.256color
[pid:17761 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
[pid:17817 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/root filename:/usr/bin/mkdir]: mkdir test
[pid:17873 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/mkdir]: mkdir test1
[pid:17874 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/less]: less /alog/snoopy.log
[pid:17875 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/bin/bash]: /bin/bash -c /usr/bin/lesspipe.sh /alog/snoopy.log
[pid:17875 uid:1001 sid:17349 tty:/dev/pts/3 cwd:/home/test filename:/usr/bin/lesspipe.sh]: /usr/bin/lesspipe.sh /alog/snoopy.log

===========================Config==================================

[snoopy]
message_format = "datetime=%{datetime} username=%{username} tty=%{tty} cmdline=%{cmdline}"
filter_chain = "only_tty;exclude_spawns_of:cron,sh"
output = file:/alog/snoopy.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.