[SaltStack] Return日志入库审计

SaltStack日志return审计

在我们执行salt任务时, 默认日志是屏幕打印的, 对于我们审计任务运行情况带来很不方便, 因此我们对日志结果进行了二次开发, 将job日志处理后入库, 方便查询.

Master推送state
```
  $ salt '<minion-id>' state.highstate --return mysql_return
```
这里指定使用mysql_return将结果日志入库审计

Master Job日志信息

  <minion-id>:
  ----------
  		ID: /tmp/salt_test.cnf
    Function: file.managed
    	Result: True
     Comment: File /tmp/salt_test.cnf is in the correct state
     Changes:
  ----------
  		ID: bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1
    Function: cron.present
  	Result: True
     Comment: Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present
     Changes:

  Summary
  ------------
  Succeeded: 2
  Failed:    0
  ------------
  Total:     2

日志中看到本次推送涉及2个子任务, 推送状态均成功.

想象一下, 这样的日志查看起来很费劲, 特别是成千上万的minion机器日志的时候, 那看的人得跪了 T.T

日志入库

这里我们展示一下日志入库后查询就特方便, 人性化 -_-

先看下我们总任务的信息

id	gmt_created	gray_job_id	exec_role	job_id	func	minion_id	success	full_ret	ret_code
1924387	2015-07-03 12:44:07	0	master	20150703124403816971	state.highstate		True	{"fun_args": [], "jid": "20150703124403816971", "return": {"file_	-/tmp/salt_test.cnf_

这里的job_id代表本次任务的id号, ret_code是所有子任务的状态信息

下来时所有子任务的结果状态

id	gmt_created	exec_role	job_id	minion_id	name	changes	success	comment
3856154	2015-07-03 12:44:07	master	20150703124403816971		/tmp/salt_test.cnf	{}	True	File /tmp/salt_test.cnf is in the correct state
3856155	2015-07-03 12:44:07	master	20150703124403816971		bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1	{}	True	Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present

总结下:

总共涉及2个子任务
exec_role表示master中心机器推送
job_id是本次任务的唯一id
子任务的sucess均为True, 表示子任务推送成功

当然这是在master上做的日志入库审计, 对应的在minion上也可以做日志入库审计.

日志表schema如下:

return_log: 总任务表

  +-------------+---------------------+------+-----+---------+----------------+
  | Field       | Type                | Null | Key | Default | Extra          |
  +-------------+---------------------+------+-----+---------+----------------+
  | id          | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
  | gmt_created | datetime            | NO   |     | NULL    |                |
  | gray_job_id | bigint(20) unsigned | NO   |     | 0       |                |
  | exec_role   | varchar(20)         | NO   |     | NULL    |                |
  | job_id      | varchar(255)        | NO   | MUL | NULL    |                |
  | func        | varchar(255)        | YES  |     | NULL    |                |
  | minion_id   | varchar(255)        | NO   | MUL | NULL    |                |
  | success     | varchar(10)         | NO   |     | NULL    |                |
  | full_ret    | mediumtext          | NO   |     | NULL    |                |
  | ret_code    | int(11)             | YES  |     | NULL    |                |
  +-------------+---------------------+------+-----+---------+----------------+

return_sublog: 子任务表

  +-------------+---------------------+------+-----+---------+----------------+
  | Field       | Type                | Null | Key | Default | Extra          |
  +-------------+---------------------+------+-----+---------+----------------+
  | id          | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
  | gmt_created | datetime            | NO   |     | NULL    |                |
  | exec_role   | varchar(20)         | NO   |     | NULL    |                |
  | job_id      | varchar(255)        | NO   | MUL | NULL    |                |
  | minion_id   | varchar(255)        | NO   |     | NULL    |                |
  | name        | mediumtext          | NO   |     | NULL    |                |
  | changes     | longtext            | YES  |     | NULL    |                |
  | success     | varchar(10)         | NO   |     | NULL    |                |
  | comment     | mediumtext          | YES  |     | NULL    |                |
  +-------------+---------------------+------+-----+---------+----------------+

return脚本:

local_return.py
mysql_minion_return.py
mysql_return.py

From reno

2015-07-03 16:40:00

[SaltStack] Return日志入库审计

SaltStack日志return审计

推荐阅读