aatarasoff/auditor repository overview
Auditor
Audit logging bridge for Docker
Auditor automatically logs start/stop events of services for Docker containers based on published ports and metadata from the container environment. Based on Registrator and supports Elasticsearch and Logstash engine.
By default, it can register services without any user-defined metadata. This means it works with any container, but allows the container author or Docker operator to override/customize the service definitions.
Getting Auditor
You can get the latest release of Auditor via Docker Hub:
$ docker pull aatarasoff/auditor:latest
Starting Auditor
$ docker run -d \
-v /var/run/docker.sock:/tmp/docker.sock \
-h $HOSTNAME aatarasoff/auditor <engine-uri>
Logstash Engine (recommended)
To use the Logstash, specify a Logstash TCP host and port. If no host is provided, 127.0.0.1:5959 is used. Examples:
$ auditor logstash://10.0.0.1:5959
$ auditor logstash:
Elasticsearch Engine
To use the Elasticsearch directly, specify a ES host and port. If no host is provided, 127.0.0.1:9200 is used. Examples:
$ auditor elastic://10.0.0.1:9200
$ auditor elastic:
Also you need to add logstash-like template to ES:
{
"template" : "containers*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true},
"dynamic_templates" : [ {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"_ttl": {
"enabled": true,
"default": "1d"
},
"properties" : {
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"type" : "object",
"dynamic": true,
"path": "full",
"properties" : {
"location" : { "type" : "geo_point" }
}
}
}
}
}
}
Tag summary
Content type
Image
Digest
sha256:1ca4888c7…
Size
4.9 MB
Last updated
about 11 years ago
docker pull aatarasoff/auditor