[SaltStack] Return日志入库审计

SaltStack日志return审计

在我们执行salt任务时, 默认日志是屏幕打印的, 对于我们审计任务运行情况带来很不方便, 因此我们对日志结果进行了二次开发, 将job日志处理后入库, 方便查询.

• Master推送state

  $ salt '' state.highstate --return mysql_return

  这里指定使用mysql_return将结果日志入库审计

• Master Job日志信息

  :
  ----------
  ID: /tmp/salt_test.cnf
  Function: file.managed
  Result: True
  Comment: File /tmp/salt_test.cnf is in the correct state
  Changes:
  ----------
  ID: bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1
  Function: cron.present
  Result: True
  Comment: Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present
  Changes:

  Summary
  ------------
  Succeeded: 2
  Failed: 0
  ------------
  Total: 2

  日志中看到本次推送涉及2个子任务, 推送状态均成功.

  想象一下, 这样的日志查看起来很费劲, 特别是成千上万的minion机器日志的时候, 那看的人得跪了 T.T

• 日志入库

  这里我们展示一下日志入库后查询就特方便, 人性化 -_-

  • 先看下我们总任务的信息

  id	gmt_created	gray_job_id	exec_role	job_id	func	minion_id	success	full_ret	ret_code
  1924387	2015-07-03 12:44:07	0	master	20150703124403816971	state.highstate		True	{"fun_args": [], "jid": "20150703124403816971", "return": {"file_	-/tmp/salt_test.cnf_

  这里的job_id代表本次任务的id号, ret_code是所有子任务的状态信息

  • 下来时所有子任务的结果状态

  id	gmt_created	exec_role	job_id	minion_id	name	changes	success	comment
  3856154	2015-07-03 12:44:07	master	20150703124403816971		/tmp/salt_test.cnf	{}	True	File /tmp/salt_test.cnf is in the correct state
  3856155	2015-07-03 12:44:07	master	20150703124403816971		bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1	{}	True	Cron bash /u01/salt_script.sh 1>/tmp/salt_script.log 2>&1 already present

  总结下:

  • 总共涉及2个子任务
  • exec_role表示master中心机器推送
  • job_id是本次任务的唯一id
  • 子任务的sucess均为True, 表示子任务推送成功

  当然这是在master上做的日志入库审计, 对应的在minion上也可以做日志入库审计.

---

日志表schema如下:

• return_log: 总任务表

  +-------------+---------------------+------+-----+---------+----------------+
  | Field | Type | Null | Key | Default | Extra |
  +-------------+---------------------+------+-----+---------+----------------+
  | id | bigint(20) unsigned | NO | PRI | NULL | auto_increment |
  | gmt_created | datetime | NO | | NULL | |
  | gray_job_id | bigint(20) unsigned | NO | | 0 | |
  | exec_role | varchar(20) | NO | | NULL | |
  | job_id | varchar(255) | NO | MUL | NULL | |
  | func | varchar(255) | YES | | NULL | |
  | minion_id | varchar(255) | NO | MUL | NULL | |
  | success | varchar(10) | NO | | NULL | |
  | full_ret | mediumtext | NO | | NULL | |
  | ret_code | int(11) | YES | | NULL | |
  +-------------+---------------------+------+-----+---------+----------------+

• return_sublog: 子任务表

  +-------------+---------------------+------+-----+---------+----------------+
  | Field | Type | Null | Key | Default | Extra |
  +-------------+---------------------+------+-----+---------+----------------+
  | id | bigint(20) unsigned | NO | PRI | NULL | auto_increment |
  | gmt_created | datetime | NO | | NULL | |
  | exec_role | varchar(20) | NO | | NULL | |
  | job_id | varchar(255) | NO | MUL | NULL | |
  | minion_id | varchar(255) | NO | | NULL | |
  | name | mediumtext | NO | | NULL | |
  | changes | longtext | YES | | NULL | |
  | success | varchar(10) | NO | | NULL | |
  | comment | mediumtext | YES | | NULL | |
  +-------------+---------------------+------+-----+---------+----------------+

---

return脚本:

• local_return.py
• mysql_minion_return.py
• mysql_return.py

From reno

2015-07-03 16:40:00