1

我目前正在使用日志收集产品，并希望能够从 AWS 中提取我的 CloudTrail 日志。我开始使用 boto3 客户端来查找 CloudTrail 中的事件。当我直接从命令行运行脚本时，我让脚本正常工作，但是一旦我尝试将它放入 cron 以随着时间的推移自动提取日志，它就停止收集日志！

以下是脚本中提取日志的基本内容示例：

    #!/usr/bin/python
    import boto3
    import datetime
    import json
    import time
    import sys
    import os

def initialize_log():
        try:
                log = open('/var/log/aws-cloudtrail.log', 'ab')
        except IOError as e:
                print "  [!] ERROR: Cannot open /var/log/aws-cloudtrail.log (%s)" % (e.strerror)
                sys.exit(1)
        return log

def date_handler(obj):
        return obj.isoformat() if hasattr(obj, 'isoformat') else obj

def read_logs(log):
        print "[+] START: Connecting to CloudTrail Logs"
        cloudTrail = boto3.client('cloudtrail')

        starttime = ""
        endtime = ""

        if os.path.isfile('/var/log/aws-cloudtrail.bookmark'):
                try:
                        with open('/var/log/aws-cloudtrail.bookmark', 'r') as myfile:
                                strdate=myfile.read().replace('\n', '')
                                starttime = datetime.datetime.strptime( strdate, "%Y-%m-%dT%H:%M:%S.%f" )
                                print "  [-] INFO: Found bookmark! Querying with a start time of " + str(starttime)
                except IOError as e:
                        print "  [!] ERROR: Cannot open /var/log/aws-cloudtrail.log (%s)" % (e.strerror)
        else:
                starttime = datetime.datetime.now() - datetime.timedelta(minutes=15)
                print "  [-] INFO: Cannot find bookmark...Querying with start time of" + str(starttime)
        endtime = datetime.datetime.now()

        print "  [-] INFO: Querying for CloudTrail Logs"
        response = cloudTrail.lookup_events(StartTime=starttime, EndTime=endtime, MaxResults=50)
        for event in response['Events']:
                log.write(json.dumps(event, default=date_handler))
                log.write("\n")
                print json.dumps(event, default=date_handler)
                print "------------------------------------------------------------"
        if 'NextToken' in response.keys():
                while 'NextToken' in response.keys():
                        time.sleep(1)
                        response = cloudTrail.lookup_events(StartTime=starttime, EndTime=endtime, MaxResults=50, NextToken=str(response['NextToken']))
                        for event in response['Events']:
                                log.write(json.dumps(event, default=date_handler))
                                log.write("\n")
                                print json.dumps(event, default=date_handler)
                                print "------------------------------------------------------------"
#       log.write("\n TESTING 1,2,3 \n")
        log.close()
        try:
                bookmark_file = open('/var/log/aws-cloudtrail.bookmark','w')
                bookmark_file.write(str(endtime.isoformat()))
                bookmark_file.close()
        except IOError as e:
                print "  [!] ERROR: Cannot set bookmark for last pull time in /var/log/aws-cloudtrail.bookmark (%s)" % (e.strerror)
                sys.exit(1)
        return True

log = initialize_log()
success = read_logs(log)

if success:
        print "[+] DONE: All results printed"
else:
        print "[+] ERROR: CloudTrail results were not able to be pulled"

我对其进行了更多研究并进行了一些测试，以确认目标文件的权限正确，并且脚本可以在从 root 的 crontab 运行时写入它们，但我仍然没有从 boto cloudtrail 客户端返回日志，除非我手动运行它。

我还检查以确保从 /root/.aws/config 正确读取默认区域并且看起来是这样，因为如果我移动它，我会看到 cron 电子邮件显示堆栈跟踪而不是我拥有的成功消息内置。

我希望有人已经遇到过这个问题，这是一个快速简单的答案！

编辑：通过实例的 IAM 角色允许对 cloudtrail 日志的权限，是的，任务安排在根的 crontab 下。

这是电子邮件输出：

From root@system  Mon Mar 28 23:00:02 2016
X-Original-To: root
From: root@system (Cron Daemon)
To: root@system
Subject: Cron <root@system> /usr/bin/python /root/scripts/get-cloudtrail.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
Date: Mon, 28 Mar 2016 19:00:02 -0400 (EDT)

[+] START: Connecting to CloudTrail Logs
  [-] INFO: Found bookmark! Querying with a start time of 2016-03-28 22:55:01.395001
  [-] INFO: Querying for CloudTrail Logs
[+] DONE: All results printed
4

0 回答 0