Merge branch 'development' of https://github.com/mmguero-dev/Malcolm

Dockerfiles/arkime.Dockerfile

@@ -148,7 +148,7 @@ RUN export DEBARCH=$(dpkg --print-architecture) && \
     mkdir -p "${ARKIME_DIR}"/plugins && \
       curl -fsSL -o "${ARKIME_DIR}/plugins/ja4plus.${DEBARCH}.so" "$(echo "${ARKIME_JA4_SO_URL}" | sed "s/XXX/${DEBARCH}/g")" && \
       chmod 755 "${ARKIME_DIR}/plugins/ja4plus.${DEBARCH}.so" && \
-    python3 -m pip install --break-system-packages --no-compile --no-cache-dir beautifulsoup4 pyzmq watchdog==4.0.2 && \
+    python3 -m pip install --break-system-packages --no-compile --no-cache-dir beautifulsoup4 pyzmq watchdog==5.0.0 && \
     ln -sfr $ARKIME_DIR/bin/npm /usr/local/bin/npm && \
       ln -sfr $ARKIME_DIR/bin/node /usr/local/bin/node && \
       ln -sfr $ARKIME_DIR/bin/npx /usr/local/bin/npx && \

Dockerfiles/file-monitor.Dockerfile

@@ -159,7 +159,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
       python-magic \
       stream-zip \
       supervisor \
-      watchdog==4.0.2 \
+      watchdog==5.0.0 \
       yara-python && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \

Dockerfiles/filebeat.Dockerfile

@@ -101,7 +101,7 @@ RUN export EVTXARCH=$(uname -m | sed 's/arm64/aarch64/') && \
         unar \
         unzip \
         xz-utils && \
-    python3 -m pip install --no-compile --no-cache-dir patool entrypoint2 pyunpack python-magic ordered-set supervisor watchdog==4.0.2 && \
+    python3 -m pip install --no-compile --no-cache-dir patool entrypoint2 pyunpack python-magic ordered-set supervisor watchdog==5.0.0 && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     curl -fsSL -o /usr/local/bin/yq "${YQ_URL}${BINARCH}" && \

Dockerfiles/pcap-monitor.Dockerfile

@@ -68,7 +68,7 @@ RUN apt-get -q update && \
       python-magic \
       pyzmq \
       requests \
-      watchdog==4.0.2 && \
+      watchdog==5.0.0 && \
     groupadd --gid ${DEFAULT_GID} ${PGROUP} && \
       useradd -M --uid ${DEFAULT_UID} --gid ${DEFAULT_GID} ${PUSER}
 

Dockerfiles/suricata.Dockerfile

@@ -108,7 +108,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
     apt-get install -q -y --no-install-recommends -t bookworm-backports \
         suricata=${SURICATA_VERSION_PATTERN} \
         suricata-update && \
-    python3 -m pip install --break-system-packages --no-compile --no-cache-dir watchdog==4.0.2 && \
+    python3 -m pip install --break-system-packages --no-compile --no-cache-dir watchdog==5.0.0 && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     curl -fsSL -o /usr/bin/yq "${YQ_URL}${BINARCH}" && \

hedgehog-iso/config/hooks/normal/0169-pip-installs.hook.chroot

@@ -20,4 +20,4 @@ pip3 install --break-system-packages --no-compile --no-cache-dir --force-reinsta
   stix2 \
   stream-zip \
   taxii2-client \
-  watchdog==4.0.2
+  watchdog==5.0.0

shared/bin/pcap_watcher.py

@@ -46,7 +46,7 @@
 
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
-from watchdog.utils import WatchdogShutdown
+from watchdog.utils import WatchdogShutdownError
 
 ###################################################################################################
 MINIMUM_CHECKED_FILE_SIZE_DEFAULT = 24
@@ -564,9 +564,9 @@ def main():
         logging.info(f"{scriptName}:\tshutting down...")
 
         if shuttingDown[0]:
-            raise WatchdogShutdown()
+            raise WatchdogShutdownError()
 
-    except WatchdogShutdown:
+    except WatchdogShutdownError:
         observer.unschedule_all()
 
     finally:

shared/bin/prune_files.sh

@@ -101,7 +101,7 @@ while true ; do
     if (( $DELETED_FILES > 0 )) ; then
       echo "Pruned $DELETED_FILES files ($(numfmt --to=iec-i --suffix=B $DELETED_BYTES)) in \"$PRUNE_PATH\""
     else
-      echo "Nothing was pruned in \"$PRUNE_PATH\"!" >&2
+      [[ "$VERBOSE" == "1" ]] && echo "Nothing was pruned in \"$PRUNE_PATH\"!" >&2
     fi
 
   else

shared/bin/watch_common.py

@@ -20,7 +20,7 @@
 
 from multiprocessing.pool import ThreadPool
 from threading import get_native_id
-from watchdog.utils import WatchdogShutdown
+from watchdog.utils import WatchdogShutdownError
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
 from collections import namedtuple, defaultdict, OrderedDict
@@ -327,9 +327,9 @@ def WatchAndProcessDirectory(
             observer.join(1)
 
         if shuttingDown[0]:
-            raise WatchdogShutdown()
+            raise WatchdogShutdownError()
 
-    except WatchdogShutdown:
+    except WatchdogShutdownError:
         observer.unschedule_all()
 
     finally:

shared/bin/zeek_carve_watcher.py

@@ -24,7 +24,7 @@
 from multiprocessing.pool import ThreadPool
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
-from watchdog.utils import WatchdogShutdown
+from watchdog.utils import WatchdogShutdownError
 
 from zeek_carve_utils import (
     CAPA_VIV_MIME,
@@ -320,9 +320,9 @@ def main():
         logging.info(f"{scriptName}:\tshutting down...")
 
         if shuttingDown[0]:
-            raise WatchdogShutdown()
+            raise WatchdogShutdownError()
 
-    except WatchdogShutdown:
+    except WatchdogShutdownError:
         observer.unschedule_all()
 
     finally: