Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migration agent-info data to Wazuh DB implementation #5541

Merged
merged 408 commits into from
Sep 29, 2020
Merged

Conversation

DProvinciani
Copy link
Contributor

@DProvinciani DProvinciani commented Jul 24, 2020

Related issue
Issue 5367

Description

This PR includes all the changes developed as part of the epic: Migration agent-info data to wazuhdb. These changes are:

  • global.db managed by Wazuh DB: Now, Wazuh DB has the capability of access global.db for either query, update or modify it. This is simplified by a set of methods that were already in the code but were modified in order to avoid accessing global.db in a regular direct way to instead make use of the Wazuh DB socket interface.

Note: When upgrading, the old global.db database is relocated from the var/db/ folder to queue/db/. In addition, the database permissions and ownership are set in order to make Wazuh DB be able to manage it. Finally, in the first manager initialization after the upgrade, the database is updated to the new schema by adding columns and tables.

  • remoted no longer creates agent-info files: The agent control messages that were stored in the agent-info folder in plain text files are now saved in the global.db. This mechanism already existed but was made in the past by wazuh-modulesd:database. Now the action is performed by remoted and no plain text files are created in the agent-info folder.

  • new sync_status column in global.db: There is a new column in global.db called sync_status that is used to reflect the synchronization status of the data in the cluster. This column is mainly used in the workers where each keepalive sets it to WDB_SYNC_REQ, and then, when the cluster requires to Wazuh DB the agents to be synchronized, it is set to WDB_SYNCED following the next state machine.

image

  • wazuh db commands for cluster synchronization: There are two new commands in Wazuh DB that are used for the agents' data synchronization in the cluster. The first one is sync-agent-info-get and is used in the worker nodes. It will return all the agents in global.db with the sync_status in WDB_SYNC_REQ. At the same time, and before returning the data, it will set that value to WDB_SYNCED. The second one is sync-agent-info-set and is used in the master nodes. It will insert all the agents' data returned by the previous one. This allows the cluster to implement the next sequence of tasks.

image

  • Vulnerability Detector working with Wazuh DB: There was a query made by Vulnerability Detector to global.db to get the list of agents connected in order to perform the scans. Now, this query is made trough Wazuh DB.

  • agent_control working with Wazuh DB: The agent_control tool no longer uses the agent-info plain text files. Now, it gets the information from global.db by executing one of the new Wazuh DB commands.

  • manage_agents working with Wazuh DB: The manage_agents tool no longer uses the agent-info plain text files. Now, it gets the information from global.db by executing one of the new Wazuh DB commands.

With the changes introduced in this pull request, a simplified architecture diagram looks like:

image

Tests

  • Compilation without warnings in every supported platform

    • Linux
    • Windows
    • MAC OS X
  • Source installation

  • Package installation

  • Source upgrade

  • Package upgrade

  • Review logs syntax and correct language

  • QA templates contemplate the added capabilities

  • Memory tests for Linux

    • Scan-build report
    • Coverity
    • Valgrind (memcheck and descriptor leaks check)
    • Dr. Memory
    • AddressSanitizer
  • Memory tests for Windows

    • Scan-build report
    • Coverity
    • Dr. Memory
  • Memory tests for macOS

    • Scan-build report
    • Leaks
    • AddressSanitizer
  • Retrocompatibility with older Wazuh versions

  • Working on cluster environments

  • Configuration on demand reports new parameters

  • The data flow works as expected (agent-manager-api-app)

  • Added unit tests (for new features)

  • Stress test for affected components

@DProvinciani DProvinciani linked an issue Jul 24, 2020 that may be closed by this pull request
@DProvinciani DProvinciani marked this pull request as ready for review August 5, 2020 01:28
@DProvinciani DProvinciani marked this pull request as draft August 5, 2020 05:06
@DProvinciani DProvinciani marked this pull request as ready for review August 5, 2020 13:18
@DProvinciani DProvinciani marked this pull request as draft August 6, 2020 20:51
@DProvinciani DProvinciani marked this pull request as ready for review August 12, 2020 20:29
@DProvinciani DProvinciani marked this pull request as draft August 19, 2020 04:27
@DProvinciani DProvinciani marked this pull request as ready for review August 21, 2020 16:32
@DProvinciani DProvinciani marked this pull request as draft August 21, 2020 17:43
@vikman90 vikman90 merged commit fd701b4 into master Sep 29, 2020
@vikman90 vikman90 deleted the dev-agent-info branch September 29, 2020 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Migration agent-info data to wazuhdb
9 participants