Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - giff

#1
Tutorials and FAQs / Telegraf input.exec not working
April 01, 2024, 07:51:39 PM
I am having issues trying to display logon sessions info with Telegraf. How I have my setup at work is we use Telegraf, Prometheus, Grafana. I have created a bash file that gets me the data I need in json

#!/bin/bash

# Use last -F to get detailed login information, grep for "logged" to filter relevant lines
last -F | grep logged | while read -r line; do
    # Extract username, login time, logout time, and duration
    # Adjust the awk command according to your specific output format
    username=$(echo "$line" | awk '{print $1}')
    login_time=$(echo "$line" | awk '{print $5, $6, $7, $8}')
    logout_time=$(echo "$line" | awk '{print $10, $11, $12, $13}')

    # Use jq to format the extracted data into JSON
    # Note: jq arguments must be passed as strings
    jq -n \
        --arg user "$username" \
        --arg login "$login_time" \
        --arg logout "$logout_time" \
        '{username: $user, login_time: $login, logout_time: $logout}'
done


Then from there my telegraf.conf file looks like this for the exec section

[[inputs.exec]]
  commands = ["/usr/local/bin/logonSessions.sh"]
  interval = "60s"
  data_format = "json"
  json_string_fields = ["username", "login_time", "logout_time"]
  name_override = "logon_sessions"
  [inputs.exec.tags]
    source = "logon_script"


We are using telegraf version 1.30. I can get other things to work without any issue but this one this seems impossible. I have ran telegraf --config --test on this and there are no issues. I have restarted telegraf. My bash script outputs correctly. I am not sure why it isn't giving me any data. I am new to all of this as my company made me the SME and I have about 4 days of experience but I need to start showing stuff on a dashboard so any help is greatly appreciated.