Reports and DRSM

Each report is a plain text file, one per host, that DRSM reads in place of an SSH check.

Report format

The server saves the report as <host>_linux_report_agent.txt. It starts with KEY: value headers (VERSION, PLATFORM: linux, HOSTNAME, ETIME, DATETIME), followed by sections of name=value lines. Values with spaces are quoted.

VERSION: 1.1
PLATFORM: linux
HOSTNAME: web1.example.com
...
PERFORMANCE:
cpu_used_pct=7.4
load_15m=0.31
mem_available_mb=5120
END PERFORMANCE

drra report prints one without sending it.

Sections

Section	Contents
SYSTEM	Release, kernel, vendor, model, serial number, virtualization, time zone
IP ADDRESS	IPv4 and IPv6 addresses of the interfaces that are up
PERFORMANCE	CPU use (5 second sample), iowait, steal, load, memory, swap, processes, uptime
DISK USAGE	Size, use and inode use of every local file system
NETWORK	Traffic, errors and drops of each interface
USERS, ACCOUNTS	Logged in sessions, accounts with a login shell
SECURITY	SELinux, firewalld or nftables, auditd, FIPS, sshd root and password login, automatic updates
FAILED SERVICES	Failed systemd units
UPDATES	Pending package updates, last package install, restart needed for a new kernel
VULNERABILITIES	Security advisories that apply, with severity, CVEs and fixed packages
COMPLIANCE	SCAP Security Guide profile score and failed rules (optional)
HOOKS	Output of the report hooks
UPLOADS	State of the hook uploads
INSTALLED PACKAGES	Every package with version and install time

With scans on, the OpenSCAP HTML reports are saved next to it as <host>_linux_scap_report.html and <host>_linux_compliance_report.html.

DRSM

The DataReel System Monitor checks hosts with COLLECTOR=lra from their last report: DRSM never connects to them. They show on the dashboard next to the SSH monitored hosts, with the same alerts and trend graphs, and their advisories show on the Vulnerabilities page. DRSM releases after 1.33 include the Linux agent plugins; for DRSM 1.33 and earlier, drsm/install.sh in the agent source code copies them in (dry run, then --apply).

Set up DRSM

Set LRA_REPORTS_DIR (the server's reports_dir) in DRSM's etc/hosts/_defaults.conf. If DRSM runs on another machine, sync the reports to it.
Make a host file for every agent report: utils/lra_hosts.sh (dry run, then --apply).
For the OpenSCAP HTML links on the Vulnerabilities page, set $LRAreportsDir in the dashboard's config/drsm.php where the uploads land.

The linux plugins

Plugin	Checks
`linux/checkin`	Report age, agent version, host facts
`linux/resources`	CPU, load, memory, swap, disks, inodes, network, with the same metrics as the SSH plugins so trends work
`linux/updates`	Pending updates, days since the last update, restart needed
`linux/security`	SELinux, firewall, auditd, sshd, failed units
`linux/vulnerabilities`	An error for critical advisories, a warning for important ones, critical CVEs with no fix yet, an old or failed scan, a low compliance score
`linux/hooks`	Every report hook; a plugin with `LRA_HOOK=<name>` shows one hook as its own check

Each plugin's settings can be changed per host in its host file, for example linux_vulnerabilities_WARN_SEVERITY=Critical.