58 lines
3.1 KiB
Bash
Executable File
58 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
set -u
|
|
cd "$(dirname "$0")"
|
|
[ -f .env ] && { set -a; . ./.env; set +a; }
|
|
|
|
section(){ printf '\n== %s ==\n' "$1"; }
|
|
|
|
section "Host / CPU"
|
|
echo "Architektur: $(uname -m 2>/dev/null || echo unknown)"
|
|
if docker compose ps clickhouse 2>/dev/null | grep -q "Restarting"; then
|
|
echo "WARNUNG: ClickHouse startet wiederholt neu."
|
|
docker compose logs --tail=30 clickhouse 2>&1 | grep -q "Illegal instruction" && echo "URSACHE: ClickHouse SIGILL / CPU-Instruktionssatz inkompatibel. ./host-info.sh ausführen." || true
|
|
fi
|
|
|
|
section "Compose config"
|
|
docker compose config >/dev/null 2>&1 && echo "OK" || echo "FEHLER: docker compose config"
|
|
|
|
section "Docker"
|
|
docker compose ps || true
|
|
|
|
section "HTTP readiness"
|
|
if command -v curl >/dev/null 2>&1; then
|
|
printf "Ingress: "; curl -fsS "http://127.0.0.1:${INGRESS_PORT:-8090}/readyz" || true; echo
|
|
printf "API: "; curl -fsS "http://127.0.0.1:${UI_PORT:-8080}/readyz" || true; echo
|
|
printf "Grafana: "; curl -fsS "http://127.0.0.1:${GRAFANA_PORT:-3000}/api/health" || true; echo
|
|
else
|
|
echo "curl fehlt; HTTP-Prüfung übersprungen."
|
|
fi
|
|
|
|
section "Garage"
|
|
docker compose exec -T garage /garage status 2>/dev/null || true
|
|
printf "S3 archive: "
|
|
docker compose exec -T archive-uploader rclone lsd "garage:${GARAGE_BUCKET:-siem-raw}" 2>/dev/null && echo "OK" || echo "nicht erreichbar"
|
|
|
|
section "ClickHouse"
|
|
docker compose exec -T clickhouse clickhouse-client \
|
|
--user "${CLICKHOUSE_USER:-siem}" --password "${CLICKHOUSE_PASSWORD:-}" \
|
|
--query "SELECT version(), currentUser(), currentDatabase()" 2>/dev/null || true
|
|
docker compose exec -T clickhouse clickhouse-client \
|
|
--user "${CLICKHOUSE_USER:-siem}" --password "${CLICKHOUSE_PASSWORD:-}" \
|
|
--database "${CLICKHOUSE_DB:-siem}" \
|
|
--query "SELECT formatReadableQuantity(sum(rows)) AS rows, formatReadableSize(sum(bytes_on_disk)) AS disk, count() AS active_parts FROM system.parts WHERE database='${CLICKHOUSE_DB:-siem}' AND table='events' AND active" 2>/dev/null || true
|
|
|
|
section "Redpanda"
|
|
docker compose exec -T redpanda rpk cluster health 2>/dev/null || true
|
|
docker compose exec -T redpanda rpk group describe "${KAFKA_GROUP:-siem-processor-v1}" 2>/dev/null || true
|
|
|
|
section "PostgreSQL control plane"
|
|
docker compose exec -T postgres psql -U "${POSTGRES_USER:-siem}" -d "${POSTGRES_DB:-siem}" -Atc \
|
|
"SELECT 'agents='||count(*) FROM agents; SELECT 'rule_sets='||count(*) FROM rule_sets; SELECT 'enabled_rules='||count(*) FROM detection_rules WHERE enabled; SELECT 'suppressions='||count(*) FROM detection_suppressions WHERE enabled AND (expires_at IS NULL OR expires_at>now()); SELECT 'open_detections='||count(*) FROM detections WHERE status IN ('open','investigating');" 2>/dev/null || true
|
|
|
|
section "Raw spool"
|
|
docker compose exec -T archive-uploader sh -c 'du -sh /spool 2>/dev/null || true; printf "files="; find /spool -type f 2>/dev/null | wc -l' 2>/dev/null || true
|
|
|
|
section "Recent errors"
|
|
docker compose logs --since=15m garage clickhouse clickhouse-schema postgres postgres-schema redpanda redpanda-init ingress processor detector api archive-uploader grafana 2>&1 \
|
|
| grep -Ei 'error|fatal|failed|panic|not_ready|exception' | tail -120 || true
|