updated the prometheus for compute13 libvirt exporter

helm-charts-observability/charts/data-prepper/values.yaml

@@ -277,6 +277,72 @@ pipelineConfig:
             value_split_characters: "="
             delete_value_regex: '^"|"$'
         
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "CWD"'
+            target_key: cwd
+            match:
+              /audit/msg: 
+              - ^cwd=\"%{GREEDYDATA:path}\"
+        
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "USER_ACCT"'
+            target_key: user_account
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "USER_ACCT"'
+            source: /user_account/msg
+            destination: /user_account/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "LOGIN"'
+            target_key: login
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} subj=%{GREEDYDATA:subject} old-auid=%{INT:old-auid} auid=%{INT:auid} tty=%{GREEDYDATA:terminal} old-ses=%{INT:old-session} ses=%{INT:session} res=%{INT:result}.*UID=\"%{WORD:user}\" OLD-AUID=\"%{WORD:OLD-AUID}\" AUID=\"%{WORD:AUID}\"
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "USER_START"'
+            target_key: user_start
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "USER_START"'
+            source: /user_start/msg
+            destination: /user_start/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+            
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "CRED_ACQ"'
+            target_key: cred_acq
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "CRED_ACQ"'
+            source: /cred_acq/msg
+            destination: /cred_acq/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+
+
         - date:
             match:
               - key: /audit/timestamp_seconds

values-kube-prometheus-stack.yaml

@@ -58,7 +58,15 @@ prometheus:
             target_label: instance
           - target_label: __address__
             replacement: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
-      
+      - job_name: 'openstack_libvirt'
+        scrape_interval: 15s
+        scrape_timeout: 10s
+        static_configs:
+          - targets:
+              - '192.168.20.103:9177'
+            labels:
+              role: 'openstack-compute-libvirt'
+              compute_host: 'compute13.brilliant.com.bd' 
 alertmanager:
   alertmanagerSpec:
     storage:

values-kube-prometheus-stack.yaml.bak-20260901-071836

@@ -0,0 +1,77 @@
+grafana:
+  enabled: true
+  adminPassword: "Enp129s0f0-0bS#rb!L!tyN#vv"
+  persistence:
+    enabled: true
+    size: 10Gi
+  service:
+    type: ClusterIP
+
+
+
+prometheus:
+  prometheusSpec:
+    retention: 30d
+    retentionSize: "45GB"
+    resources:
+      requests: { cpu: 500m, memory: 1Gi }
+      limits: { cpu: "2", memory: 4Gi }
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources: { requests: { storage: 50Gi } }
+    
+    configMaps:
+      - blackbox-targets
+
+    additionalScrapeConfigs:
+      - job_name: 'cpanel-node'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9100']
+            labels: { role: 'cpanel-host' }
+      - job_name: 'cpanel-apache'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9117']
+      - job_name: 'cpanel-mariadb'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9104']
+      - job_name: 'cpanel-process'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9256']
+      - job_name: 'cpanel-whm'
+        static_configs: 
+          - targets: ['bwebhosting.brilliant.com.bd:9124']
+      - job_name: 'bind-dns'
+        static_configs:
+        - targets: ['dns1.intercloud-bd.net:9119','dns2.intercloud-bd.net:9119','dns3.intercloud-bd.net:9119']
+      - job_name: 'blackbox-http'
+        metrics_path: /probe
+        params: { module: [http_2xx] }
+        file_sd_configs:
+          - files:
+              - /etc/prometheus/configmaps/blackbox-targets/targets.json
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
+      
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources: { requests: { storage: 5Gi } }
+  config:
+    route:
+      receiver: 'default'
+      group_by: ['alertname', 'role']
+      group_wait: 30s
+      repeat_interval: 4h
+    receivers:
+      - name: default
+