elastic / elastic/fleet-server

Send a (/var/log) directory listing to Fleet and display it on the Agent status page

Open
#1,535 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
113
Forks
117
Avg merge
1d 16h
Merged PRs (30d)
112

Description

Sometimes we need to gather more logs from our installed Agents but in the blind we are not always sure what is relevant and what not. The team that manages Elastic Stack does not always have access to the hosts where the Agents are running.
The system owner or sysadmin use sssd or sometimes they use shibolet for authentication of other different services. For security reasons we need to gather all relevant logs.
When we configure the Agent Integrations we would like to have a bit of visibility from the Agent beforehand.

It would be ideal to send a directory listing to Fleet and display it on the Agent status page,
e.g. /var/log. Could also be a list of directories. Default: []

On our former log storage solution we've had an Agent config flag that could have been set:
list_log_files:
- /var/log

We request something similar in Fleet and in the Agent configuration.

Extra nice perks:
Recently modified files where highlighted in a different color. To help even more on identifying active logs.
I'm thinking this could be pushed with the "Last activity" or health status

This used to look like this:
![image](https://user-images.githubusercontent.com/22619253/172472389-c6b2a1c9-26ad-4866-a0e1-5560904e9c6a.png)

![image](https://user-images.githubusercontent.com/22619253/172472217-d6a9e2e8-02b0-4a67-9cfc-8bce87995d1b.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.