Use case:
Monitor CPU and memory usage of docker containers using Wazuh.
Wazuh Configuration:
Within the Wazuh UI, Navigate to Management -> Groups then edit the group configuration to add:
<localfile>
<command>docker stats --format "{{.Container}} {{.Name}} {{.CPUPerc}} {{.MemUsage}}" --no-stream</command>
<frequency>60</frequency>
<log_format>command</log_format>
<out_format>$(timestamp) $(hostname) docker: $(log)</out_format>
</localfile>The above command will be executed every minute to send an update about the resources to the Wazuh manager.
Then add the decoders and rules to parse and convey the needed information.
Decoders:
<decoder name="dockerR">
<program_name>docker</program_name>
</decoder>
<decoder name="docker-resouces">
<parent>dockerR</parent>
<prematch>ossec: output: 'docker stats --format "{{.Container}} {{.Name}} {{.CPUPerc}} {{.MemUsage}}" --no-stream':</prematch>
<regex offset="after_prematch"> (\S+) (\S+) (\S+) (\S+) / (\S+)</regex>
<order>ContainerID, ContainerName, ContainerCPU, ContainerMemoryUsage, ContainerMemroyAvailable </order>
</decoder>Rule:
<group name="docker">
<rule id="100005" level="5">
<decoded_as>dockerR</decoded_as>
<description>alert docker ressources</description>
</rule>
</group>Result:
DEMO:
I hope you find it useful 🙂
12 responses to “Monitor Docker Containers Resources using Wazuh”
An interesting discussion is price comment. I think that you must write more on this topic, it may not be a taboo topic but usually individuals are not enough to talk on such topics. To the next. Cheers
stromectol tablets buy online – stromectol for sale tegretol for sale online
buy isotretinoin tablets – linezolid pills linezolid 600mg pills
cost amoxil – order valsartan 80mg combivent 100 mcg sale
zithromax 500mg pill – zithromax 250mg generic buy nebivolol without a prescription
omnacortil 10mg without prescription – order prednisolone generic order generic progesterone
buy furosemide 40mg generic – buy furosemide 40mg for sale order betnovate 20gm cream
buy cheap clavulanate – nizoral 200mg generic buy cymbalta 20mg pills
order doxycycline without prescription – purchase glipizide generic glipizide 5mg price
purchase augmentin – duloxetine 40mg uk buy duloxetine 40mg online cheap
Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.
cost semaglutide 14mg – how to get cyproheptadine without a prescription periactin without prescription