Add conf to host, move plugin to sbin

dockers/docker-fpm-frr/Dockerfile.j2

@@ -56,14 +56,14 @@ COPY ["TS", "/usr/bin/TS"]
 COPY ["files/supervisor-proc-exit-listener", "/usr/bin"]
 COPY ["zsocket.sh", "/usr/bin/"]
 COPY ["*.json", "/etc/rsyslog.d/"]
-# COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
+COPY ["files/rsyslog_plugin.conf.j2", "/etc/rsyslog.d/"]
 RUN chmod a+x /usr/bin/TSA && \
     chmod a+x /usr/bin/TSB && \
     chmod a+x /usr/bin/TSC && \
     chmod a+x /usr/bin/zsocket.sh
 
-# RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/bgp_events.conf
-# RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2*
+RUN j2 -f json /etc/rsyslog.d/rsyslog_plugin.conf.j2 /etc/rsyslog.d/events_info.json  > /etc/rsyslog.d/bgp_events.conf
+RUN rm -f /etc/rsyslog.d/rsyslog_plugin.conf.j2*
 RUN rm -f /etc/rsyslog.d/events_info.json*
 
 ENTRYPOINT ["/usr/bin/docker_init.sh"]

files/build_templates/events_info.json

@@ -0,0 +1,13 @@
+{
+    "yang_module": "sonic-events-host",
+    "proclist": [
+        {
+            "name": "monit",
+	    "parse_json": "monit_regex.json"
+        },
+        {
+            "name": "sshd",
+            "parse_json": "sshd_regex.json"
+        }
+    ]
+}

files/build_templates/monit_regex.json

@@ -0,0 +1,17 @@
+[
+    {
+        "tag": "disk-usage",
+        "regex": ".([a-zA-Z0-9-_]*). space usage (\\d+\\.\\d+)% matches resource limit .space usage.(\\d+\\.\\d+)%.",
+        "params": [ "fs", "usage", "limit" ]
+    },
+    {
+        "tag": "memory-usage",
+        "regex": "mem usage of (\\d+\\.\\d+)% matches resource limit .mem usage>(\\d+\\.\\d+)%.",
+        "params": [ "usage", "limit" ]
+    },
+    {
+        "tag": "cpu-usage",
+        "regex": "cpu user usage of (\\d+\\.\\d+)% matches resource limit .cpu user usage>(\\d+\\.\\d+)%.",
+        "params": [ "usage", "limit" ]
+    }
+]

files/build_templates/rsyslog_plugin.conf.j2

@@ -12,7 +12,7 @@ $ModLoad omprog
 {% for proc in proclist %}
 if re_match($programname, "{{ proc.name }}") then {
     action(type="omprog"
-        binary="/usr/share/sonic/scripts/rsyslog_plugin -r /etc/rsyslog.d/{{ proc.parse_json }} -m {{ yang_module }}"
+        binary="/usr/sbin/rsyslog_plugin -r /etc/rsyslog.d/{{ proc.parse_json }} -m {{ yang_module }}"
         output="/var/log/rsyslog_plugin.log"
         template="prog_msg")
 }

files/build_templates/sonic_debian_extension.j2

@@ -323,6 +323,12 @@ sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/sonic-db-cli_*.deb || \
 sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/sonic-rsyslog-plugin_*.deb || \
     sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
 
+# Generate host conf for rsyslog_plugin
+j2 -f json $BUILD_TEMPLATES/rsyslog_plugin.conf.j2 $BUILD_TEMPLATES/events_info.json > $BUILD_TEMPLATES/host_events.conf
+sudo mv $BUILD_TEMPLATES/host_events.conf $FILESYSTEM_ROOT_ETC/rsyslog.d/ 
+sudo cp $BUILD_TEMPLATES/monit_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
+sudo cp $BUILD_TEMPLATES/sshd_regex.json $FILESYSTEM_ROOT_ETC/rsyslog.d/
+
 # Install custom-built monit package and SONiC configuration files
 sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/monit_*.deb || \
     sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f

files/build_templates/sshd_regex.json

@@ -0,0 +1,7 @@
+[
+    {
+        "tag": "event-sshd",
+        "regex": "auth fail: Password Incorrect. user:.([a-zA-Z0-9-_]*)",
+        "params": [ "username" ]
+    }
+]

src/sonic-eventd/Makefile

@@ -72,7 +72,7 @@ rsyslog-plugin-tests: $(RSYSLOG-PLUGIN-TEST_OBJS)
 
 install:
 	$(MKDIR) -p $(DESTDIR)/usr/sbin
-	$(MKDIR) -P $(DESTDIR)/etc/monit/conf.d
+	$(MKDIR) -p $(DESTDIR)/etc/monit/conf.d
 	$(CP) $(EVENTD_TARGET) $(DESTDIR)/usr/sbin
 	$(CP) $(EVENTD_TOOL) $(DESTDIR)/usr/sbin
 	$(CP) $(EVENTD_PUBLISH_TOOL) $(DESTDIR)/usr/sbin

src/sonic-eventd/debian/control

@@ -2,7 +2,7 @@ Source: sonic-eventd
 Section: devel
 Priority: optional
 Maintainer: Renuka Manavalan <remanava@microsoft.com>
-Build-Depends: debhelper (>= 12.0.0), libevent-dev, libboost-thread-dev, libboost-system-dev, libswsscommon-dev liblua5.1-0
+Build-Depends: debhelper (>= 12.0.0), libevent-dev, libboost-thread-dev, libboost-system-dev, libswsscommon-dev, liblua5.1-0
 Standards-Version: 3.9.3
 Homepage: https://github.com/Azure/sonic-buildimage
 XS-Go-Import-Path: github.com/Azure/sonic-buildimage

src/sonic-eventd/tools/monit_events

@@ -1,6 +1,6 @@
 ###############################################################################
 ## Monit configuration for telemetry container
 ###############################################################################
-check program container_eventd with path "/usr/local/bin/events_monit_test.py"
+check program container_eventd with path "/usr/sbin/events_monit_test.py"
     every 5 cycles
     if status != 0 for 3 cycle then alert repeat every 1 cycles