golden hour

/opt/osquery/share/osquery/lenses

File/Folder	Size	Actions
COPYING	25.91 KB
access.aug	3.58 KB
activemq_conf.aug	1.47 KB
activemq_xml.aug	864 B
afs_cellalias.aug	1.56 KB
aliases.aug	2.18 KB
anaconda.aug	775 B
anacron.aug	2.49 KB
approx.aug	1.26 KB
apt_update_manager.aug	1.11 KB
aptcacherngsecurity.aug	726 B
aptconf.aug	3.9 KB
aptpreferences.aug	1.79 KB
aptsources.aug	1.98 KB
authorized_keys.aug	1.84 KB
automaster.aug	3.31 KB
automounter.aug	4.05 KB
avahi.aug	1.38 KB
backuppchosts.aug	1014 B
bbhosts.aug	4.24 KB
bootconf.aug	3.65 KB
build.aug	16.65 KB
cachefilesd.aug	2 KB
carbon.aug	1.54 KB
ceph.aug	719 B
cgconfig.aug	3.37 KB
cgrules.aug	2.38 KB
channels.aug	3.84 KB
chrony.aug	12.87 KB
clamav.aug	1.53 KB
cobblermodules.aug	398 B
cobblersettings.aug	2.24 KB
collectd.aug	869 B
cpanel.aug	824 B
cron.aug	4.05 KB
cron_user.aug	1.26 KB
crypttab.aug	3.01 KB
csv.aug	1.18 KB
cups.aug	459 B
cyrus_imapd.aug	1.51 KB
darkice.aug	773 B
debctrl.aug	3.61 KB
desktop.aug	1.39 KB
devfsrules.aug	619 B
device_map.aug	620 B
dhclient.aug	6.69 KB
dhcpd.aug	20.88 KB
dns_zone.aug	2.89 KB
dnsmasq.aug	2.16 KB
dovecot.aug	3.98 KB
dpkg.aug	2.78 KB
dput.aug	2.16 KB
erlang.aug	4.33 KB
ethers.aug	663 B
exports.aug	2.37 KB
fai_diskconfig.aug	9.28 KB
fonts.aug	819 B
fstab.aug	1.23 KB
fuse.aug	871 B
gdm.aug	1.8 KB
getcap.aug	1.57 KB
group.aug	1.66 KB
grub.aug	11.04 KB
grubenv.aug	508 B
gshadow.aug	2.19 KB
gtkbookmarks.aug	855 B
host_conf.aug	1.9 KB
hostname.aug	435 B
hosts.aug	485 B
hosts_access.aug	4.32 KB
htpasswd.aug	1.02 KB
httpd.aug	7.35 KB
inetd.aug	6.22 KB
inifile.aug	15.49 KB
inittab.aug	780 B
inputrc.aug	1.62 KB
interfaces.aug	4.62 KB
iproute2.aug	323 B
iptables.aug	2.64 KB
iscsid.aug	684 B
jaas.aug	1.57 KB
jettyrealm.aug	1.52 KB
jmxaccess.aug	1.35 KB
jmxpassword.aug	1.34 KB
json.aug	2.15 KB
kdump.aug	2.91 KB
keepalived.aug	10.7 KB
known_hosts.aug	1.93 KB
koji.aug	898 B
krb5.aug	6.16 KB
ldif.aug	7.65 KB
ldso.aug	1.06 KB
lightdm.aug	1.75 KB
limits.aug	2.02 KB
login_defs.aug	615 B
logrotate.aug	4.22 KB
logwatch.aug	1.44 KB
lokkit.aug	2.16 KB
lvm.aug	2.03 KB
mailscanner.aug	1.66 KB
mailscanner_rules.aug	2.84 KB
masterpasswd.aug	4.36 KB
mcollective.aug	1.09 KB
mdadm_conf.aug	10.05 KB
memcached.aug	1.24 KB
mke2fs.aug	4.67 KB
modprobe.aug	3.34 KB
modules.aug	741 B
modules_conf.aug	1.04 KB
mongodbserver.aug	1.17 KB
monit.aug	2.13 KB
multipath.aug	4.21 KB
mysql.aug	1.95 KB
nagioscfg.aug	2.09 KB
nagiosobjects.aug	1.57 KB
netmasks.aug	1.69 KB
networkmanager.aug	2 KB
networks.aug	1.09 KB
nginx.aug	3.65 KB
nrpe.aug	1.75 KB
nslcd.aug	9.87 KB
nsswitch.aug	2.33 KB
ntp.aug	5.29 KB
ntpd.aug	4.75 KB
odbc.aug	1.42 KB
opendkim.aug	3.08 KB
openshift_config.aug	2.46 KB
openshift_http.aug	1.03 KB
openshift_quickstarts.aug	1.02 KB
openvpn.aug	22.28 KB
oz.aug	1.35 KB
pagekite.aug	2.6 KB
pam.aug	2.58 KB
pamconf.aug	1.23 KB
passwd.aug	3.52 KB
pbuilder.aug	638 B
pg_hba.aug	2.97 KB
pgbouncer.aug	1.43 KB
php.aug	2.34 KB
phpvars.aug	3.85 KB
postfix_access.aug	771 B
postfix_main.aug	1.52 KB
postfix_master.aug	1.9 KB
postfix_passwordmap.aug	1.28 KB
postfix_sasl_smtpd.aug	697 B
postfix_transport.aug	1.48 KB
postfix_virtual.aug	1.32 KB
postgresql.aug	2.1 KB
properties.aug	2.3 KB
protocols.aug	1.05 KB
puppet.aug	1.52 KB
puppet_auth.aug	1.95 KB
puppetfile.aug	2.27 KB
puppetfileserver.aug	3.12 KB
pylonspaste.aug	2.3 KB
pythonpaste.aug	1.99 KB
qpid.aug	670 B
quote.aug	6.71 KB
rabbitmq.aug	4.69 KB
radicale.aug	1.48 KB
rancid.aug	927 B
redis.aug	4.96 KB
reprepro_uploaders.aug	5.47 KB
resolv.aug	3.87 KB
rhsm.aug	1.1 KB
rmt.aug	788 B
rsyncd.aug	1.97 KB
rsyslog.aug	3.17 KB
rtadvd.aug	854 B
rx.aug	4.06 KB
samba.aug	1.71 KB
schroot.aug	1.79 KB
securetty.aug	450 B
semanage.aug	859 B
sep.aug	1.28 KB
services.aug	2.82 KB
shadow.aug	2.35 KB
shells.aug	745 B
shellvars.aug	11.97 KB
shellvars_list.aug	1.74 KB
simplelines.aug	1.13 KB
simplevars.aug	1.34 KB
sip_conf.aug	1.61 KB
slapd.aug	5.2 KB
smbusers.aug	781 B
solaris_system.aug	3.15 KB
soma.aug	1.14 KB
spacevars.aug	1.42 KB
splunk.aug	1.64 KB
squid.aug	15.95 KB
ssh.aug	3.91 KB
sshd.aug	4.01 KB
sssd.aug	861 B
star.aug	941 B
strongswan.aug	1.63 KB
stunnel.aug	2.21 KB
subversion.aug	2.75 KB
sudoers.aug	20.03 KB
sysconfig.aug	2.49 KB
sysconfig_route.aug	2.55 KB
sysctl.aug	923 B
syslog.aug	7.33 KB
systemd.aug	5.88 KB
termcap.aug	1.03 KB
thttpd.aug	1.31 KB
tmpfiles.aug	3.03 KB
toml.aug	4.06 KB
trapperkeeper.aug	4.01 KB
tuned.aug	387 B
up2date.aug	2.21 KB
updatedb.aug	1.13 KB
util.aug	4.85 KB
vfstab.aug	1.71 KB
vmware_config.aug	702 B
vsftpd.aug	2.72 KB
webmin.aug	1.23 KB
wine.aug	1.92 KB
xendconfsxp.aug	1.07 KB
xinetd.aug	4.02 KB
xml.aug	6.33 KB
xorg.aug	10.43 KB
xymon.aug	2.26 KB
xymon_alerting.aug	6.11 KB
yaml.aug	1.54 KB
yum.aug	2.19 KB

Edit: mdadm_conf.aug

(******************************************************************************
Mdadm_conf module for Augeas

Author: Matthew Booth <mbooth@redhat.com>

Reference:
    mdadm(5)
    config.c and policy.c from mdadm-3.2.2

License:
    This file is licensed under the LGPL v2+.

This is a lens for /etc/mdadm.conf. It aims to parse every valid configuration
file as of version 3.2.2, and many invalid ones too. This last point is a
feature, not a bug! madm will generate warnings for invalid configuration which
do not prevent correct operation of the tool. Wherever possible, we try to
allow for this behaviour.

Keywords in mdadm.conf are matched with a case-insensitive prefix match of at
least 3 characters. Keys in key/value pairs are also matched case-insensitively,
but require a full match. The exception is POLICY and PART-POLICY, where keys
are matched case-sensitively.

N.B. We can't use case-insensitive regular expressions in most places due to bug
#147.
*******************************************************************************)

module Mdadm_conf =

autoload xfm

(******************************************************************************
 * PRIMITIVES
 ******************************************************************************)

let eol             = Util.comment_or_eol
let comment         = Util.comment
let empty           = Util.empty
let value           = /[^ \t\n#]+/
let value_no_eq     = /[^ \t\n#=]+/
let value_no_eq_sl  = /[^ \t\n#=\/]+/

let continuation = /\n[ \t]+/
let space = /[ \t]+/
let value_sep = ( del ( continuation | space . continuation? ) " "
                  | comment . del space " " )

(* We parse specific keys rather than having a catch-all owing to the varying
case of the syntax. This means the user can rely on 'array/uuid' rather than
additionally testing for 'array/UUID'.

It would be good to have an additional catchall, but I haven't been able to make
that work.
*)
let keyvalue (r:regexp) (lc:string) (uc:string) =
    [ del ( r . /=/ ) ( uc . "=" ) . label lc . store value ]

let simplevalue (r:regexp) (lc:string) (uc:string) =
    [ del r uc . label lc
      . ( value_sep . [ label "value" . store value ] )* . eol ]

(******************************************************************************
 * DEVICES
 ******************************************************************************)

let dev_re = /dev(i(ce?)?)?/i

let dev_containers_re = /containers/i
let dev_partitions_re = /partitions/i

let dev_containers = [ del dev_containers_re "containers" . label "containers" ]
let dev_partitions = [ del dev_partitions_re "partitions" . label "partitions" ]
let dev_device = [ label "name". store ( value - (dev_containers_re | dev_partitions_re)) ]

(* Strictly there must be at least 1 device, but we err on the side of parsing
*)
let dev_devices = ( value_sep . ( dev_containers
                                  | dev_partitions
                                  | dev_device ) )*

let device = [ del dev_re "DEVICE" . label "device" . dev_devices . eol ]

(******************************************************************************
 * ARRAY
 ******************************************************************************)

let array_re  = /arr(ay?)?/i

let arr_auto_re         = /auto/i
let arr_bitmap_re       = /bitmap/i
let arr_container_re    = /container/i
let arr_devices_re      = /devices/i
let arr_disks_re        = /disks/i (* Undocumented *)
let arr_level_re        = /level/i
let arr_member_re       = /member/i
let arr_metadata_re     = /metadata/i
let arr_name_re         = /name/i
let arr_num_devices_re  = /num-devices/i
let arr_spare_group_re  = /spare-group/i
let arr_spares_re       = /spares/i
let arr_super_minor_re  = /super-minor/i
let arr_uuid_re         = /uuid/i

let arr_devicename      = [ store value_no_eq . label "devicename" ]

let arr_auto        = keyvalue arr_auto_re "auto" "AUTO"
let arr_bitmap      = keyvalue arr_bitmap_re "bitmap" "BITMAP"
let arr_container   = keyvalue arr_container_re "container" "CONTAINER"
let arr_devices     = keyvalue arr_devices_re "devices" "DEVICES"
let arr_disks       = keyvalue arr_disks_re "disks" "DISKS"
let arr_level       = keyvalue arr_level_re "level" "LEVEL"
let arr_member      = keyvalue arr_member_re "member" "MEMBER"
let arr_metadata    = keyvalue arr_metadata_re "metadata" "METADATA"
let arr_name        = keyvalue arr_name_re "name" "NAME"
let arr_num_devices = keyvalue arr_num_devices_re "num-devices" "NUM-DEVICES"
let arr_spare_group = keyvalue arr_spare_group_re "spare-group" "SPARE-GROUP"
let arr_spares      = keyvalue arr_spares_re "spares" "SPARES"
let arr_super_minor = keyvalue arr_super_minor_re "super-minor" "SUPER-MINOR"
let arr_uuid        = keyvalue arr_uuid_re "uuid" "UUID"

let array  = [ del array_re "ARRAY" . label "array" . arr_options . eol ]

(******************************************************************************
 * MAILADDR
 ******************************************************************************)

let mailaddr_re = /mai(l(a(d(dr?)?)?)?)?/i

(* We intentionally allow multiple mailaddr values here, even though this is
invalid and would produce a warning. This is better than not parsing the file.
*)
let mailaddr = simplevalue mailaddr_re "mailaddr" "MAILADDR"

(******************************************************************************
 * MAILFROM
 ******************************************************************************)

(* N.B. MAILFROM can only be abbreviated to 5 characters *)
let mailfrom_re = /mailf(r(om?)?)?/i

let mailfrom = [ del mailfrom_re "MAILFROM" . label "mailfrom"
                 . ( value_sep . [ label "value" . store value ] )* . eol ]

(******************************************************************************
 * PROGRAM
 ******************************************************************************)

let program_re = /pro(g(r(am?)?)?)?/i

let program = simplevalue program_re "program" "PROGRAM"

(******************************************************************************
 * CREATE
 ******************************************************************************)

let create_re = /cre(a(te?)?)?/i

let cre_auto_re     = /auto/i
let cre_owner_re    = /owner/i
let cre_group_re    = /group/i
let cre_mode_re     = /mode/i
let cre_metadata_re = /metadata/i
let cre_symlinks_re = /symlinks/i

let cre_auto        = keyvalue cre_auto_re "auto" "AUTO"
let cre_group       = keyvalue cre_group_re "group" "GROUP"
let cre_metadata    = keyvalue cre_metadata_re "metadata" "METADATA"
let cre_mode        = keyvalue cre_mode_re "mode" "MODE"
let cre_owner       = keyvalue cre_owner_re "owner" "OWNER"
let cre_symlinks    = keyvalue cre_symlinks_re "symlinks" "SYMLINKS"

let create  = [ del create_re "CREATE" . label "create" . cre_options . eol ]

(******************************************************************************
 * HOMEHOST
 ******************************************************************************)

let homehost_re = /hom(e(h(o(st?)?)?)?)?/i

let homehost = simplevalue homehost_re "homehost" "HOMEHOST"

(******************************************************************************
 * AUTO
 ******************************************************************************)

let auto_re = /auto?/i

let aut_plus        = [ key "+" . store value ]
let aut_minus       = [ key "-" . store value ]
let aut_homehost    = [ del /homehost/i "homehost" . label "homehost" ]

let aut_list = ( value_sep . ( aut_plus | aut_minus | aut_homehost ) )*

let auto = [ del auto_re "AUTO" . label "auto" . aut_list . eol ]

(******************************************************************************
 * POLICY and PART-POLICY
 ******************************************************************************)

(* PART-POLICY is undocumented. A cursory inspection of the parsing code
suggests it's parsed the same way as POLICY, but treated slightly differently
thereafter. *)

let policy_re = /pol(i(cy?)?)?/i
let part_policy_re = /par(t(-(p(o(l(i(cy?)?)?)?)?)?)?)?/i

(* Unlike everything else, policy keys are matched case sensitive. This means we
don't have to mess around with explicit option matching, as the match string is
fixed for a working configuration. *)

let pol_option (act:string) =
    [ del ( act . "=" ) ( act . "=" ) . label act . store value ]

let pol_options = ( value_sep . [ key value_no_eq_sl . del "=" "="
                                  . store value ] )*

let policy      = [ del policy_re "POLICY" . label "policy"
                    . pol_options . eol ]
let part_policy = [ del part_policy_re "PART-POLICY" . label "part-policy"
                    . pol_options . eol ]

(******************************************************************************
 * LENS
 ******************************************************************************)

let filter     = incl "/etc/mdadm.conf"
               . incl "/etc/mdadm/mdadm.conf"

let xfm        = transform lns filter