idaholab#127, have install.py --configure ask about other storage loc…

…ations for PCAP, zeek logs and opensearch indices
cisagov · Nov 18, 2022 · 2fc15d4 · 2fc15d4
1 parent 9f73809
commit 2fc15d4
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/scripts/install.py b/scripts/install.py
@@ -1234,6 +1234,24 @@ def tweak_malcolm_runtime(
                                     sectionIndents[currentSection] * 3,
                                 )
 
+                        elif currentService == 'file-monitor':
+                            # stuff specifically in the file-monitor section
+                            if re.match(r'^\s*-.+:/zeek/extract_files(:.+)?\s*$', line):
+                                # file-monitor's reference to the zeek-logs/extract_files directory
+                                line = ReplaceBindMountLocation(
+                                    line,
+                                    os.path.join(zeekLogDir, 'extract_files'),
+                                    sectionIndents[currentSection] * 3,
+                                )
+
+                            elif re.match(r'^\s*-.+:/zeek/logs(:.+)?\s*$', line):
+                                # zeek's reference to the zeek-logs/current directory
+                                line = ReplaceBindMountLocation(
+                                    line,
+                                    os.path.join(zeekLogDir, 'current'),
+                                    sectionIndents[currentSection] * 3,
+                                )
+
                         elif currentService == 'logstash':
                             # stuff specifically in the logstash section
                             if 'LS_JAVA_OPTS' in line: