From 7c7c2dc9388049807b7e023bd7343d6f72c7f142 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 30 Mar 2026 19:47:32 +0000 Subject: [PATCH 1/4] Bump pygments from 2.19.2 to 2.20.0 Bumps [pygments](https://github.com/pygments/pygments) from 2.19.2 to 2.20.0. - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](https://github.com/pygments/pygments/compare/2.19.2...2.20.0) --- updated-dependencies: - dependency-name: pygments dependency-version: 2.20.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/uv.lock b/uv.lock index 866cec4..fe8ea49 100644 --- a/uv.lock +++ b/uv.lock @@ -904,11 +904,11 @@ wheels = [ [[package]] name = "pygments" -version = "2.19.2" +version = "2.20.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" }, + { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" }, ] [[package]] From 6669436a0e2ddfc6a8590d305e4a613312d81987 Mon Sep 17 00:00:00 2001 From: whotwagner Date: Tue, 31 Mar 2026 22:01:25 +0200 Subject: [PATCH 2/4] Bump version from 0.2.1 to 0.2.2 --- src/service/metadata.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/service/metadata.py b/src/service/metadata.py index 26210b6..c921337 100644 --- a/src/service/metadata.py +++ b/src/service/metadata.py @@ -7,7 +7,7 @@ __website__ = 'https://aecid.ait.ac.at' __license__ = 'EUPL-1.2' __status__ = 'Development' -__version__ = '0.2.1' +__version__ = '0.2.2' __all__ = [ '__authors__', '__contact__', From 34b8779393b9178b630cbb5dce7eb4e8184fc09c Mon Sep 17 00:00:00 2001 From: whotwagner Date: Wed, 15 Apr 2026 10:10:58 +0200 Subject: [PATCH 3/4] Update Docker command to use sudo for pipeline start --- docs/getting_started.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting_started.md b/docs/getting_started.md index 811882a..9656c07 100644 --- a/docs/getting_started.md +++ b/docs/getting_started.md @@ -434,7 +434,7 @@ detectors: Here, the `URL` token from the parsed data is monitored (`- pos: URL`), and the first two log lines are used for training (`data_use_training: 2`). Any subsequent log lines will be evaluated for anomalies and compared against the values seen during training on the first two log lines. -Now let's start the pipeline using `docker compose up -d` and send two valid log lines with two different status values: +Now let's start the pipeline using `sudo docker compose up -d` and send two valid log lines with two different status values: ``` alice@ubuntu2404:~/DetectMateService$ sudo docker compose up -d @@ -457,7 +457,7 @@ prometheus prom/prometheus:latest "/bin/prometheus - alice@ubuntu2404:~/DetectMateService$ ``` -Wait a couple of minutes until parser and detector containers are up and running. You can check by executing `docker compose logs parser` or `docker compose logs detector`. +Wait a couple of minutes until parser and detector containers are up and running. You can check by executing `sudo docker compose logs parser` or `sudo docker compose logs detector`. The output of the component should show `Uvicorn running on` or any HTTP-requests for the /metrics endpoint: ``` From 9e07964b7cd1810ecd16dfa6bbb61f807101aff9 Mon Sep 17 00:00:00 2001 From: thorinaboenke Date: Fri, 17 Apr 2026 10:24:27 +0200 Subject: [PATCH 4/4] typos getting started --- docs/getting_started.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/getting_started.md b/docs/getting_started.md index 9656c07..06207ee 100644 --- a/docs/getting_started.md +++ b/docs/getting_started.md @@ -226,14 +226,14 @@ alice@ubuntu2404:~/DetectMateService$ sudo docker compose down -v ``` We have finally all requirements installed and have a boilerplate template for docker compose that starts an initial pipeline. In the next sections we will reconfigure that -pipeline so that we can read the access.log and generate anomalies. +pipeline so that we can read the `access.log` and generate anomalies. ## Mount the access.log -The preconfigured pipeline reads logs from `container/fluentlogs/some.log`. In order to be able to read the nginx access.log file, we need to mount /var/log/nginx into the fluentin container +The preconfigured pipeline reads logs from `container/fluentlogs/some.log`. In order to be able to read the nginx access.log file, we need to mount `/var/log/nginx` into the fluentin container and modify the fluentd config so that it reads access.log instead. -Initially we edit the docker-compose.yml and change only the line 11 to use `/var/log/nginx`: +Initially we edit the `docker-compose.yml` and change only the line 11 to use `/var/log/nginx`: ``` # version: "3" @@ -344,7 +344,7 @@ volumes: driver: local ``` -Now that the access.logs are available in the container, we have to point fluentd to read that file. We need to edit the file `container/fluentin/fluent.conf` and replace `path /fluentd/log/some.log` with `path /fluentd/log/access.log`: +Now that the `access.logs` are available in the container, we have to point fluentd to read that file. We need to edit the file `container/fluentin/fluent.conf` and replace `path /fluentd/log/some.log` with `path /fluentd/log/access.log`: ``` @@ -381,7 +381,7 @@ generate anomalies. ## DetectMate Config -The log pipeline uses two DetectMate services, parser and detector. The parser splits the log line into meaningful tokens, which the detector then uses to identify anomalies. We need to configure the parser and detector. Since detector needs to know which tokens it receives from the parser so it can look for anomalies, the two configurations are closely related. +The log pipeline uses two DetectMate services, parser and detector. The parser splits the log line into meaningful tokens, which the detector then uses to identify anomalies. We need to configure the parser and detector. Since the detector needs to know which tokens it receives from the parser so it can look for anomalies, the two configurations are closely related. ### Parser @@ -457,8 +457,8 @@ prometheus prom/prometheus:latest "/bin/prometheus - alice@ubuntu2404:~/DetectMateService$ ``` -Wait a couple of minutes until parser and detector containers are up and running. You can check by executing `sudo docker compose logs parser` or `sudo docker compose logs detector`. -The output of the component should show `Uvicorn running on` or any HTTP-requests for the /metrics endpoint: +**Wait a couple of minutes until parser and detector containers are up and running.** You can check by executing `sudo docker compose logs parser` or `sudo docker compose logs detector`. +When the containers are ready, the output of the component will show `Uvicorn running on` or any HTTP-requests for the `/metrics` endpoint: ``` parser-1 | [2026-03-18 15:21:45,017] INFO detectmatelibrary.parsers.json_parser.MatcherParser.b7ce95e085705d4d87b71db2d1392f08: setup_io: ready to process messages @@ -473,7 +473,7 @@ parser-1 | INFO: 172.18.0.2:43378 - "GET /metrics HTTP/1.1" 200 OK parser-1 | INFO: 172.18.0.2:39840 - "GET /metrics HTTP/1.1" 200 OK ``` -Now generate two access.log lines: +Now generate two `access.log` lines: ``` alice@ubuntu2404:~/DetectMateService$ curl http://localhost/hello @@ -495,7 +495,7 @@ alice@ubuntu2404:~/DetectMateService$ curl http://localhost/world alice@ubuntu2404:~/DetectMateService$ ``` -We now trained with the two values `hello` and `world`. This means, as soon as we query any other url than `/hello` or `/world` we should receive an anomaly. Anomalies get logged in `container/fluentlogs/output.%Y%m%d`. With `cat container/fluentlogs/output.%Y%m%d` find the filename `buffer..log` and have a look: +We now trained with the two values `hello` and `world`. This means, as soon as we query any other url than `/hello` or `/world` we should receive an anomaly. Anomalies get logged in `container/fluentlogs/output.%Y%m%d`. With `ls container/fluentlogs/output.%Y%m%d` find the filename `buffer..log` and have a look: ``` alice@ubuntu2404:~/DetectMateService$ curl http://localhost/foobar