{"id":16387922,"url":"https://github.com/dotmpe/x-docker-sagan","last_synced_at":"2026-06-24T07:31:47.596Z","repository":{"id":65054460,"uuid":"223683010","full_name":"dotmpe/x-docker-sagan","owner":"dotmpe","description":"Testing Sagan log-analyzer in docker","archived":false,"fork":false,"pushed_at":"2023-01-13T08:59:23.000Z","size":31,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-22T12:25:14.409Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dotmpe.png","metadata":{"files":{"readme":"ReadMe.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-24T02:41:53.000Z","updated_at":"2022-12-21T06:13:43.000Z","dependencies_parsed_at":"2023-02-09T15:16:20.912Z","dependency_job_id":null,"html_url":"https://github.com/dotmpe/x-docker-sagan","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/dotmpe/x-docker-sagan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotmpe%2Fx-docker-sagan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotmpe%2Fx-docker-sagan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotmpe%2Fx-docker-sagan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotmpe%2Fx-docker-sagan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dotmpe","download_url":"https://codeload.github.com/dotmpe/x-docker-sagan/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dotmpe%2Fx-docker-sagan/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34722670,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-24T02:00:07.484Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-11T04:27:54.596Z","updated_at":"2026-06-24T07:31:47.576Z","avatar_url":"https://github.com/dotmpe.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"This is part of dev/Cloud/SIEM\n\nA test setup for Sagan.\n\n- Sagan is a log processor.\n- Meer is a log spooler\n- EveBox is a web frontend (for Suricata+ES, but can read EVE JSON into sqlite)\n- Enterprise Log Search and Archive (ELSA)\n\n\n# Images\n\n[2023-01-13]\n: [baseimage focal (master)](https://hub.docker.com/layers/dotmpe/sagan-dev/2.0.2-focal-syslogng/images/sha256-4711c948a7a7f888785164a900df4a2fe8126c08a20b00e2b3478911963ffda3)\n  ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/dotmpe/sagan-dev/2.0.2-focal-syslogng?style=flat-square)\n\n  [baseimage focal (1.2.0)](https://hub.docker.com/layers/dotmpe/sagan-dev/2.0.2-focal-1.2.0/images/sha256-23afa3fafaa91f94ee1557689fdc4aa974fef925066a5372cc1063eee1c54f5a)\n  ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/dotmpe/sagan-dev/2.0.2-focal-1.2.0?style=flat-square)\n\n\n# Containerized Sagan\n\nBuild from ./Dockerfile.\n\nTo compile `sagan-dev:baseimage-${base}` and run use:\n```\n./run-sagan.sh\n```\nWhere `base` is `master|latest|0.11|...` (`phusion/baseimage` tag)\n\nTo test:\n```\ndocker exec -ti sagan_dev logger -t sshd \"User ubuntu not allowed because shell /etc/passwd is not executable\"\n```\n\nTo use, point rsyslog to send logs to UDP 5514.\n\nRun sa-mode EveBox ``./run-evebox.sh`` web UI at :5636\n\n\n# Syslog receiver\nSyslogNG because that ships with phusion/baseimage.\n\n10-sagan-pipe.conf works, but even when using HOST the hostnames do not show\nup anywhere in Sagan, even if dns lookup seems to work OK (otherwise default-\nhost is used).\n\n10-sagan-json.conf does not work with almost same setup, it defaults the source\nadress.\n\n\n# Status\nUsing baseimage so syslog receiver can run beside sagan.\nSee syslog section.\n\nOccasionally the FIFO open seems to stall but then it is just waiting for a new\nsyslog message to appear on through the pipe. Normal startup should report\nsomething like this:\n```\n\n  Dec 23 20:44:39 sagan-dev sagan[87]: [*] \n  Dec 23 20:44:39 sagan-dev sagan[87]: [*] Attempting to open syslog FIFO (/var/run/sagan.fifo).\n  Dec 23 20:44:39 sagan-dev sagan[87]: [*] Successfully opened FIFO (/var/run/sagan.fifo).\n  Dec 23 20:44:39 sagan-dev sagan[87]: [*] FIFO capacity is 65536 bytes.  Changing to 1048576 bytes.\n```\n\n\n# Log\n\n[2022-12-24] \n: Tried to configure stack using docker, but having trouble with hostnames.\n  Need to use DNS since SyslogNG only passes hostnames for the event origin,\n  but when in a container the localhost IP changes to docker network.\n\n  running container in `host` network mode\n\n[2022-12-21]\n: Committing accumulated, some initial script to build ELSA image as well but\n  that is pretty stale and EveBox runs fine.\n  Looked at (but not using) quadrantsec/meer, a spooler that can enrich as well.\n\nv0.2\n: New build based on phusion/baseimage. Configured to receive local syslog-ng.\n  Still uses the old `docker/run.sh` and config generator.\n\nv0.1\n: Initial running server [2019-11-23](log/2019-11-23.md)\n\n\n#### Bugs\n- Cannot build with `configure.sh --disable-syslog`:\n  ```\n  config-yaml.c: In function ‘Load_YAML_Config’:\n  config-yaml.c:2816:1: error: expected declaration or statement at end of input\n   }\n  ```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdotmpe%2Fx-docker-sagan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdotmpe%2Fx-docker-sagan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdotmpe%2Fx-docker-sagan/lists"}