securityonion-sostat: check for syslog-ng drops

dougburks commented 5 years ago

sostat should check for syslog-ng drops via syslog-ng-ctl stats

dougburks commented 5 years ago

The following package is now available at ppa:securityonion/test:

securityonion-sostat - 20120722-0ubuntu0securityonion134

Please test as follows:

add the test PPA:

sudo add-apt-repository -y ppa:securityonion/test

install updates:
```
sudo soup
```
run sostat and verify that there is a new syslog-ng section near the bottom of the output:
```
sudo sostat
```
create some syslog-ng drops by stopping logstash:
```
sudo so-logstash-stop
```

create some logs:

for i in $(seq 1 100); do logger test; done

run sostat again and verify that the new syslog-ng section now includes a warning about syslog-ng drops:
```
sudo sostat
```
verify no regressions
anything else we missed?

Thanks in advance for your time and effort!

weslambert commented 5 years ago

Looks good from my testing 👍

dougburks commented 5 years ago

Thanks @weslambert !

Security-Onion-Solutions / security-onion