Files not being collected

[antonikaram11]

Thought to share some issues I have been running with the UAC 3.1 and wanted to raise it if there was something I am doing wrong or modifications that I'd need to do.

I have ran the "full" profile and noticed some files were not collected under the /etc folder. More specifically the rc[0-6].d folder.

I have also noticed that not all systemd files are collected (more specifically the user systemd).

[tclahr]

This is probably because rc[0-6].d and the user systemd files are all symlinks. UAC filters out non-regular files from the collection to avoid issues during the output file creation.

What is the Linux flavor you are running UAC on?

I am planning to run some tests to confirm if symlinks can be added to the output file without impacting or causing any issues.

[antonikaram11]

I ran UAC on Ubuntu 20.04.6 LTS - I have seen a file_type value of "l" in the documentation but unsure if that is related to the use case.

[tclahr]

The file_type: [f] property was removed from the artifacts below:

artifacts/files/logs/advanced_log_search.yaml
artifacts/files/logs/apache.yaml
artifacts/files/logs/macos.yaml
artifacts/files/logs/macos_unified_logs.yaml
artifacts/files/logs/netscaler.yaml
artifacts/files/logs/nginx.yaml
artifacts/files/logs/run_log.yaml
artifacts/files/logs/solaris.yaml
artifacts/files/logs/tomcat.yaml
artifacts/files/logs/var_adm.yaml
artifacts/files/logs/var_log.yaml
artifacts/files/logs/var_run_log.yaml
artifacts/files/system/dev_shm.yaml
artifacts/files/system/etc.yaml
artifacts/files/system/gvfs_metadata.yaml
artifacts/files/system/netscaler.yaml
artifacts/files/system/run_shm.yaml
artifacts/files/system/systemd.yaml
artifacts/files/system/tmp.yaml
artifacts/files/system/udev.yaml
artifacts/files/system/var_tmp.yaml

[tclahr]

Changes were pushed to develop branch via #372 .

[william-billaud]

I need to make some test when time permit but it look like this issue will revert #338, especially on folder collection.
e.g :

artifacts/files/logs/var_log.yaml

version: 3.2
artifacts:
  -
    description: Collect /var/log logs.
    supported_os: [aix, esxi, freebsd, linux, netbsd, netscaler, openbsd, solaris]
    collector: file
    path: /var/log
    file_type: [f]
    max_file_size: 1073741824 # 1GB

Maybe it would be better to replace file_type: [f] by file_type: [f,l]

[tclahr]

You are right. I will update the artifacta that have max or min file size and also update the artifact validation to raise an error when max or min file size is set and file type is not f.