Audit Log Login

Background: The company's audit logs often appear without logging commands, but can not monitor whether the audit function is normal. So our idea is to ssh into each host from the CMDB server every day. If the audit function is normal, you must have a logged-in record in the Auditlog.info file. If there is no change in this file within 24 hours, it indicates that the audit function of the host is abnormal and the log cannot be logged.

Create a logon script

#!/usr/bin/env python2.7import commands,requests,json#host_ip = ' 10.47.102.185 ' url = ' http://10.47.102.185/api/ecs ' r    = Requests.get (URL) ecss = Json.loads (r.text) for I in ecss:host_ip = i.get (' IP ') # if host_ip! = ' 10.174.107.151 ': Status,result = Commands.getstatusoutput (' ssh-o connecttimeout=3-o stricthostkeychecking=no [email protected]{0} '        echo \ "Audit Check\" "". Format (HOST_IP)) if status = = 0:print ' {0} Check Success '. Format (HOST_IP) Else: print ' {0} check failed '. Format (HOST_IP)

Connecttimeout=3 indicates a time-out of 3 seconds

Stricthostkeychecking

The first SSH login prompts to confirm yes/no, confirm Yes will add the remote node to the local ~/.ssh/known_hosts, the next time you connect the same node is no longer prompt. For the convenience of not confirm, you can use the following parameters login

ssh-o stricthostkeychecking=no ...

This will no longer confirm and automatically add information from the remote host to the ~/.ssh/known_hosts.

To create a daily scheduled task:

1 * * * root/usr/bin/python2.7/srv/script/audit_check.py

Trigger:

{Template OS linux:vfs.file.cksum[/var/log/userlog.info].diff (0)}=0

Audit Log Login