From 6da1b19698965e3ee89a74a826091ba19e39c18d Mon Sep 17 00:00:00 2001 From: dfolcha Date: Thu, 2 Sep 2021 10:17:07 +0200 Subject: [PATCH 1/3] Exclude queue/ossec from volume --- wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 2 +- wazuh-odfe/config/permanent_data.env | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index b45dced5..fbc08153 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -84,7 +84,7 @@ remove_data_files() { if [ -e ${del_file} ] then print "Removing ${del_file}" - exec_cmd "rm ${del_file}" + exec_cmd "rm -rf ${del_file}" fi done } diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 47f5c06b..3c259ff7 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,6 +4,8 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" +PERMANENT_DATA[((i++))]="/var/ossec/queue/sockets" +PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/ossec/integrations" @@ -62,4 +64,5 @@ export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" +PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/ossec" export PERMANENT_DATA_DEL From 68bc08f78f2cf4920d958e10752a6622ff19700e Mon Sep 17 00:00:00 2001 From: dfolcha Date: Thu, 2 Sep 2021 17:05:23 +0200 Subject: [PATCH 2/3] Add function to rename files and directories --- .../config/etc/cont-init.d/0-wazuh-init | 20 +++++++++++++++++++ wazuh-odfe/config/permanent_data.env | 7 +++++-- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index fbc08153..46697125 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -74,6 +74,23 @@ apply_exclusion_data() { done } +############################################################################## +# This function will rename in the permanent data volume every file +# contained in PERMANENT_DATA_MOVE +############################################################################## + +move_data_files() { + for mov_file in "${PERMANENT_DATA_MOVE[@]}"; do + file_split=( $mov_file ) + if [ -e ${file_split[0]} ] + then + print "moving ${mov_file}" + exec_cmd "mv -f ${mov_file}" + fi + done +} + + ############################################################################## # This function will delete from the permanent data volume every file # contained in PERMANENT_DATA_DEL @@ -158,6 +175,9 @@ main() { # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) apply_exclusion_data + # Rename files stored in permanent data (i.e. queue/ossec) + move_data_files + # Remove some files in permanent_data (i.e. .template.db) remove_data_files diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 3c259ff7..9ec743af 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,7 +4,6 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" -PERMANENT_DATA[((i++))]="/var/ossec/queue/sockets" PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" @@ -64,5 +63,9 @@ export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" -PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/ossec" export PERMANENT_DATA_DEL + +i=0 +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" +export PERMANENT_DATA_MOVE \ No newline at end of file From 413dd71d4436d977acc52a24eca8b26a549606f8 Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 3 Sep 2021 09:16:20 +0200 Subject: [PATCH 3/3] Remove -r flag --- wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index 46697125..e3c9ebfa 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -101,7 +101,7 @@ remove_data_files() { if [ -e ${del_file} ] then print "Removing ${del_file}" - exec_cmd "rm -rf ${del_file}" + exec_cmd "rm -f ${del_file}" fi done }