diff --git a/docs/configuration.md b/docs/configuration.md index 390e85b..e6c6023 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -158,7 +158,7 @@ page in this section: |------------------------|---------------------|----------------|---------------| | juniper_netscreen | netscreen:firewall | netfw | none | -Here is a snippet from the `splunk_indexes.csv` file: +Here is a snippet from the `splunk_index.csv` file: ```bash juniper_netscreen,index,ns_index @@ -185,7 +185,7 @@ In general, for most deployments the index should be the only change needed; oth never be overridden (particularly for the "Out of the Box" data sources). Even then, care should be taken when considering any alternates, as the defaults for SC4S were chosen with best practices in mind. -The `splunk_indexes.csv` file should also be appended to (with a "commented out" default for the index) when building custom SC4S log paths +The `splunk_index.csv` file should also be appended to (with a "commented out" default for the index) when building custom SC4S log paths (filters). Care should be taken during filter design to choose appropriate index, sourctype and template defaults, so that admins are not compelled to override them. @@ -198,7 +198,7 @@ which maps to an associated lookup of alternate indexes, sources, or other metad added to futher classify the data. * The `conf` and `csv` files referenced below will be populated into the `/opt/sc4s/local/context` directory when SC4S is run for the first -time after being set up according to the "getting started" runtime documents, in a similar fashion to `splunk_indexes.csv`. +time after being set up according to the "getting started" runtime documents, in a similar fashion to `splunk_index.csv`. After this first-time population of the files takes place, they can be edited (and SC4S restarted) for the changes to take effect. To get started: * Edit the file ``compliance_meta_by_source.conf`` to supply uniquely named filters to identify events subject to override. diff --git a/docs/gettingstarted/docker-swarm-general.md b/docs/gettingstarted/docker-swarm-general.md index dea3f12..818dd2f 100644 --- a/docs/gettingstarted/docker-swarm-general.md +++ b/docs/gettingstarted/docker-swarm-general.md @@ -86,8 +86,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start. * In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes -will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated -regularly, and should be used as a template to merge new/changed functionality into existing context files. +will be preserved on a restart. * Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events (if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration" diff --git a/docs/gettingstarted/docker-swarm-rhel7.md b/docs/gettingstarted/docker-swarm-rhel7.md index 8c1d6f1..06bd095 100644 --- a/docs/gettingstarted/docker-swarm-rhel7.md +++ b/docs/gettingstarted/docker-swarm-rhel7.md @@ -94,8 +94,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start. * In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes -will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated -regularly, and should be used as a template to merge new/changed functionality into existing context files. +will be preserved on a restart. * Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events (if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration" diff --git a/docs/gettingstarted/docker-systemd-general.md b/docs/gettingstarted/docker-systemd-general.md index 70f2128..6bb6d4a 100644 --- a/docs/gettingstarted/docker-systemd-general.md +++ b/docs/gettingstarted/docker-systemd-general.md @@ -90,8 +90,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start. * In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes -will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated -regularly, and should be used as a template to merge new/changed functionality into existing context files. +will be preserved on a restart. * Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events (if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration" diff --git a/docs/gettingstarted/podman-systemd-general.md b/docs/gettingstarted/podman-systemd-general.md index fedde53..e42da7b 100644 --- a/docs/gettingstarted/podman-systemd-general.md +++ b/docs/gettingstarted/podman-systemd-general.md @@ -109,8 +109,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start. * In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes -will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated -regularly, and should be used as a template to merge new/changed functionality into existing context files. +will be preserved on a restart. * Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events (if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration" diff --git a/package/sbin/entrypoint.sh b/package/sbin/entrypoint.sh index 0faf2db..b3607b6 100755 --- a/package/sbin/entrypoint.sh +++ b/package/sbin/entrypoint.sh @@ -47,7 +47,7 @@ mkdir -p /opt/syslog-ng/etc/conf.d/local/config/ cp /opt/syslog-ng/etc/context_templates/* /opt/syslog-ng/etc/conf.d/local/context for file in /opt/syslog-ng/etc/conf.d/local/context/*.example ; do cp --verbose -n $file ${file%.example}; done -#splunk_indexes.csv updates +#splunk_index.csv updates #Remove comment headers from existing config touch /opt/syslog-ng/etc/conf.d/local/context/splunk_index.csv sed -i 's/^#//' /opt/syslog-ng/etc/conf.d/local/context/splunk_index.csv