Collect outdated packages (apt list --upgradable) through UF

[worm929]

Hey guys,

you know how you can run $ apt list --upgradable and get a list of all the packages that have a pending update?
I want to get that info from all my linux host in Splunk, so I can see: "this host has 100 pending updates", etc.

I can think of many ways to do it, but the most elegant one I believe would be using the UF with a script to get the data (in a very similar way as the Add-on for Unix does it). The problem is, I've never done such a thing and I'm very new to this.

Has someone done this before? any pointers? any other solution that would be better? (i.e: I don't want to have to run a cronjob to create a log to then ingest that, it makes it difficult to distribute to all hosts)

thanks!

[martin_mueller]

All you need is a one-liner shell script or whatever fancy thing you want to build, and tell the UF to run it on a schedule: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Getdatafromscriptedinputs#Add_a_scripted_inpu...
The forwarder will take stdout from the script, and send it off to be indexed. Make sure your script prints out a timestamp before the actual output, that way you'll make your splunking life so much easier.