[SaltStack] Return日志入库审计

SaltStack日志return审计

在我们执行salt任务时, 默认日志是屏幕打印的, 对于我们审计任务运行情况带来很不方便, 因此我们对日志结果进行了二次开发, 将job日志处理后入库, 方便查询.

• Master推送state

    $ salt '<minion-id>' state.highstate --return mysql_return
  

  这里指定使用mysql_return将结果日志入库审计

• Master Job日志信息

    <minion-id>:
    ----------
    		ID: /tmp/salt_test.cnf
      Function: file.managed
      	Result: True
       Comment: File /tmp/salt_test.cnf is in the correct state
       Changes:
    ----------
    		ID: bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1
      Function: cron.present
    	Result: True
       Comment: Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present
       Changes:
  
    Summary
    ------------
    Succeeded: 2
    Failed:    0
    ------------
    Total:     2
  

  日志中看到本次推送涉及2个子任务, 推送状态均成功.

  想象一下, 这样的日志查看起来很费劲, 特别是成千上万的minion机器日志的时候, 那看的人得跪了 T.T

• 日志入库

  这里我们展示一下日志入库后查询就特方便, 人性化 -_-

  • 先看下我们总任务的信息

  id	gmt_created	gray_job_id	exec_role	job_id	func	minion_id	success	full_ret	ret_code
  1924387	2015-07-03 12:44:07	0	master	20150703124403816971	state.highstate		True	{"fun_args": [], "jid": "20150703124403816971", "return": {"file_	-/tmp/salt_test.cnf_

  这里的job_id代表本次任务的id号, ret_code是所有子任务的状态信息

  • 下来时所有子任务的结果状态

  id	gmt_created	exec_role	job_id	minion_id	name	changes	success	comment
  3856154	2015-07-03 12:44:07	master	20150703124403816971		/tmp/salt_test.cnf	{}	True	File /tmp/salt_test.cnf is in the correct state
  3856155	2015-07-03 12:44:07	master	20150703124403816971		bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1	{}	True	Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present

  总结下:

  • 总共涉及2个子任务
  • exec_role表示master中心机器推送
  • job_id是本次任务的唯一id
  • 子任务的sucess均为True, 表示子任务推送成功

  当然这是在master上做的日志入库审计, 对应的在minion上也可以做日志入库审计.

---

日志表schema如下:

• return_log: 总任务表

    +-------------+---------------------+------+-----+---------+----------------+
    | Field       | Type                | Null | Key | Default | Extra          |
    +-------------+---------------------+------+-----+---------+----------------+
    | id          | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
    | gmt_created | datetime            | NO   |     | NULL    |                |
    | gray_job_id | bigint(20) unsigned | NO   |     | 0       |                |
    | exec_role   | varchar(20)         | NO   |     | NULL    |                |
    | job_id      | varchar(255)        | NO   | MUL | NULL    |                |
    | func        | varchar(255)        | YES  |     | NULL    |                |
    | minion_id   | varchar(255)        | NO   | MUL | NULL    |                |
    | success     | varchar(10)         | NO   |     | NULL    |                |
    | full_ret    | mediumtext          | NO   |     | NULL    |                |
    | ret_code    | int(11)             | YES  |     | NULL    |                |
    +-------------+---------------------+------+-----+---------+----------------+
  

• return_sublog: 子任务表

    +-------------+---------------------+------+-----+---------+----------------+
    | Field       | Type                | Null | Key | Default | Extra          |
    +-------------+---------------------+------+-----+---------+----------------+
    | id          | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
    | gmt_created | datetime            | NO   |     | NULL    |                |
    | exec_role   | varchar(20)         | NO   |     | NULL    |                |
    | job_id      | varchar(255)        | NO   | MUL | NULL    |                |
    | minion_id   | varchar(255)        | NO   |     | NULL    |                |
    | name        | mediumtext          | NO   |     | NULL    |                |
    | changes     | longtext            | YES  |     | NULL    |                |
    | success     | varchar(10)         | NO   |     | NULL    |                |
    | comment     | mediumtext          | YES  |     | NULL    |                |
    +-------------+---------------------+------+-----+---------+----------------+
  

---

return脚本:

• local_return.py
• mysql_minion_return.py
• mysql_return.py

From reno

2015-07-03 16:40:00