InfraSonar Windows Event Log Probe

Environment variable

Variable	Default	Description
`AGENTCORE_HOST`	`127.0.0.1`	Hostname or Ip address of the AgentCore.
`AGENTCORE_PORT`	`8750`	AgentCore port to connect to.
`INFRASONAR_CONF`	`/data/config/infrasonar.yaml`	File with probe and asset configuration like credentials.
`MAX_PACKAGE_SIZE`	`500`	Maximum package size in kilobytes (1..2000).
`MAX_CHECK_TIMEOUT`	`300`	Check time-out is 80% of the interval time with `MAX_CHECK_TIMEOUT` in seconds as absolute maximum.
`DRY_RUN`	none	Do not run demonized, just return checks and assets specified in the given yaml (see the Dry run section below).
`LOG_LEVEL`	`warning`	Log level (`debug`, `info`, `warning`, `error` or `critical`).
`LOG_COLORIZED`	`0`	Log using colors (`0`=disabled, `1`=enabled).
`LOG_FTM`	`%y%m%d %H:%M:%S`	Log format prefix.
`EVENTLOG_LAST_RUN_FN`	`/data/eventlog_last_run.mp`	Location of file which we use to store eventlog check last run times.

docker build -t eventlog-probe . --no-cache

Available checks:

Create a yaml file, for example (test.yaml):

asset:
  name: "foo.local"
  check: "eventlog"
  config:
    address: "192.168.1.2"
    eventCodes: [400, 600]

Run the probe with the DRY_RUN environment variable set the the yaml file above.

DRY_RUN=test.yaml python main.py