Intercept Backend: FS (filesystem)

Driver name: fs

• intercept_buffer_max_size isn't currently supported.
• %u variable won't work with login-intercept plugin.

Configuration Options

intercept_fs

Default	[None]
Value	string

Path to the intercept storage.

Variable substitutions supported:

Variable	Long Name	Description
%u	user	user@domain
%n	username	user
%d	domain	domain
%s	service	imap/pop3/lmtp
%l	lip	local IP
%r	rip	remote IP
%a	lport	local port
%b	rport	remote port
%h	home	user's home directory
	session	session ID
	crypted_user	user@domain encrypted and hex-encoded
	year	Time (year), e.g., 2012
	month	Time (month), e.g., 01..12
	day	Time (day), e.g., 01..31
	hour	Time (hour), e.g., 00..23
	min	Time (minute), e.g., 00..59
	sec	Time (second), e.g., 00..59

intercept_fs_header_line

Default	[None]
Value	string

Add a header to the log.

See intercept_fs for supported variable substitutions.

intercept_fs_rotate_at_midnight

Default	no
Value	boolean

Rotate the log at midnight (server's local timezone).

intercept_fs_rotate_interval

Default	[None]
Value	time

Flush log and create a new one this often.

intercept_fs_rotate_size

Default	[None]
Value	size

Rotate the log when it reaches this size.

intercept_user_crypt_cipher

Default	aes-256-cbc
Value	string
See Also	intercept_user_crypt_key

Encryption cipher used to generate the %{crypted_user} variable.

intercept_user_crypt_key

Default	[None]
Value	string
See Also	intercept_user_crypt_cipher

Secret encryption key used to generate the %{crypted_user} variable.

Example Configuration

plugin {
  intercept_backend = fs

  # POSIX interception
  intercept_fs = posix:prefix=/tmp/intercept/%u/%s-
  # TODO: dictmap example

  # Add a header to the log
  intercept_fs_header_line = rip=%r service=%s user=%u

  # Flush log and create a new one every this often
  intercept_fs_rotate_interval = 5min

  # Rotate the log at midnight (server's local timezone)
  intercept_fs_rotate_at_midnight = yes

  # Turn on fs debug
  import_environment = $import_environment INTERCEPT_LOG_DEBUG=yes
}