https://docs.saltstack.com/en/latest/topics/beacons/index.html
https://docs.saltstack.com/en/latest/ref/beacons/all/index.html#all-salt-beacons

1 在minion上定义beacon
beacons:
  service:
    httpd:
      onchangeonly: True
      uncleanshutdown: /var/run/httpd/httpd.pid
只要httpd的状态放生改变就会给master发送事件
2 你要知道发送的event长什么样
salt/beacon/centos2/service/    {
    "_stamp": "2015-12-06T07:24:25.095014",
    "data": {
        "httpd": {
            "running": false,
            "shutdown": "clean"
        },
        "id": "centos2"
    },
    "tag": "salt/beacon/centos2/service/"
}

3 编写master配置文件，监听相对应的tag
vim /etc/salt/master
reactor:
  - 'salt/beacon/znode2/service/':
    - '/srv/reactor/backup.sls'

4 编写触发文件
vim /srv/reactor/backup.sls
{%if data['data']['httpd']['running'] == False %}
backup file:
  local.cmd.run:
    - tgt: {{data['data']['id']}}
    - arg:
      - "/etc/init.d/httpd start"
{%endif%}

#如果调用的是state.sls 还要编写相对应的sls文件


自定义beacon插件
1 mkdir -pv /srv/salt/_beacons
2 在这个目录下编写插件
3 同步
salt '*' saltutil.sync_all

4 vim t.py
#你在minion配置文件中的字典，会赋值给config
beacons:
  t:
    - rm: /tmp/kk
    - interval: 2

函数的返回值必须是[{'t1':1},{'t2':2}]

导入你需要的模块
import 模块名字
def beacon(config):
    ret = []
    r_dict = {}
    拆分config然后去做你想做的判断
    然后把返回值追加到ret
    return ret

做一个最简单的审计系统
# -*- coding: utf-8 -*-

import logging
import re
import pexpect
log = logging.getLogger(__name__)

__virtualname__ = 't'

"""
def __virtual__():
    if salt.utils.is_windows():
        return False
    else:
        return __virtualname__
"""

def beacon(config):
    '''
    code_block:: yaml

        beacons:
          t:
            - rm : /
            - interval: 100
    '''
    ret = []
    user = __salt__['cmd.run']('whoami')
    logging.debug(user)
    r_dict = {}
    for t in config:
        for k,v in t.items():
            cmd = "grep '^.*rm.* /tmp/kk[[:space:]]$' /tmp/.shellog"
            output, status = pexpect.run(cmd, withexitstatus=1)
            if status == 0 :
                logging.debug(output)
                r_dict = { user : output}
                logging.debug(r_dict)
                ret.append(r_dict)

    return ret