New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Restructure network information from the Syscollector tables #144
Labels
Comments
We would also need to unify the outputs from If an agent doesn't have a specific value for some property, return an empty string. Regards, |
The following DB request should be used in order to retrieve all necessary information at once: # sqlite3 /var/ossec/queue/db/000.db
SQLite version 3.22.0 2018-01-22 18:45:57
Enter ".help" for usage hints.
sqlite> select * from sys_netiface, sys_netproto, sys_netaddr where sys_netiface.name = sys_netproto.iface and sys_netiface.scan_id = sys_netproto.scan_id and sys_netproto.type = sys_netaddr.proto and sys_netaddr.scan_id = sys_netproto.scan_id group by sys_netproto.type, sys_netiface.name;
1565191792|2018/09/27 09:16:18|enp0s3||ethernet|up|1500|08:00:27:51:40:EB|1029|1879|80930|2192819|0|0|0|0|1565191792|enp0s3|ipv4|10.0.2.2|enabled|1565191792|ipv4|192.168.185.3|255.255.255.0|192.168.185.255
1565191792|2018/09/27 09:16:18|enp0s8||ethernet|up|1500|08:00:27:00:69:88|8728|9071|1814245|3706736|0|0|0|0|1565191792|enp0s8|ipv4|unknown|enabled|1565191792|ipv4|192.168.185.3|255.255.255.0|192.168.185.255
1565191792|2018/09/27 09:16:18|enp0s3||ethernet|up|1500|08:00:27:51:40:EB|1029|1879|80930|2192819|0|0|0|0|1565191792|enp0s3|ipv6||enabled|1565191792|ipv6|fe80::a00:27ff:fe51:40eb|ffff:ffff:ffff:ffff::|
1565191792|2018/09/27 09:16:18|enp0s8||ethernet|up|1500|08:00:27:00:69:88|8728|9071|1814245|3706736|0|0|0|0|1565191792|enp0s8|ipv6||enabled|1565191792|ipv6|fe80::a00:27ff:fe51:40eb|ffff:ffff:ffff:ffff::| |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Due to normalize reasons, the network interfaces information is stored by Syscollector in three different tables from one single JSON event collected by Syscollector.
Here we have an interface event before decode it.
This information is stored in the tables
sys_netiface
,sys_netaddr
andsys_netproto
using reference IDs. So, the API retrieves the information from the separated tables as follows:This behavior doesn't allow the App to print a table with the network interfaces information due to it comes from different API queries. Is that why it would be necessary to restructure the data when reading it from the DB to get something similar to the JSON event coming from the agent.
The text was updated successfully, but these errors were encountered: