LightKeeper

LightKeeper is a notification daemon. At the moment, LK supports sending a Telegram message when a line appears in a file. Optionally, it is possible to define one or more filters, so you won’t get flooded.

Features

• ✓ File input

• ✓ Monitoring for changes in input file

• ❏ Network input

• ❏ JournalD input

• ❏ Input file position recovery after restart

• ✓ Filtering based on syslog-ng logger (program)

• ❏ Filtering based on arbitrary regex

• ❏ Stdout output (handy for debugging)

• ✓ Telegram output

• ❏ Slack output

• ✓ Support for multiplexing (same input mapped to multiple outputs)

• ❏ Error handling

• ✓ OPKG Package for Turris Omnia

• ❏ OPKG Repository

• ❏ Debian package

• ❏ RedHat package

Use case

Sending logs about SSH activity from Turris Omnia to Telegram

Prerequisites

1. Telegram bot token

2. Your Telegram userId or chatId where bot is invited (tested only with userId)

3. GNU sed (brew install gnu-sed on macOS)

4. GNU tar (brew install gnu-tar on macOS)

Building and Installing

Build the package:

make opkg-omnia

opkg (.ipk) package will be available in /build/ipkbuild subfolder, called lightkeeper-x.y.z.ipk

Copy to router:

# Replace root and 192.168.1.1 with your router username and IP/hostname
$ scp ./build/ipkgbuild/lightkeeper-x.y.z.ipk root@192.168.1.1:/tmp/lk.ipk

Install:

$ ssh root@192.168.1.1
root@router:~# opkg install /tmp/lk.ipk

Configuration

Create config providing Telegram configuration

cat <<EOF > /etc/ligthkeeper/config.toml
# We create an input called "in"
[inputs.in]
# We must specify type "file"
type = "file"
# Specify file path which to monitor
params.path = "/var/log/messages"

# We configure a list of 1 mapping
[[mappings]]
# We specify "in" input from above
from = "in"
# We'll send to "out" defined below
to = "out"
# We define a list of 1 filter
[[mappings.filters]]
type = "syslog-ng"
program = "sshd"

# We define an output called "out"
[outputs.out]
# We'll output to telegram
type = "telegram"
# Modify this
params.token = "<TelegramToken"
# Modify this
params.chatId = "<TelegramChatId>"
EOF

Enable LightKeeper service

/etc/init.d/lightkeeper enable
/etc/init.d/lightkeeper start