update services artifact to use systemctl plugin

Author: djoreilly

artifacts/definitions/SUSE/Linux/Events/Services.yaml

@@ -3,25 +3,17 @@ name: SUSE.Linux.Events.Services
 description: |
   This artifact collects new systemd services events.
 
-required_permissions:
-  - EXECVE
-
 precondition: |
   SELECT OS From info() where OS = 'linux'
 
 type: CLIENT_EVENT
 
 sources:
   - query: |
-      -- grok pattern to parse systemctl show output
-      LET pattern = "%{NUMBER:pid}\n\{ path\=%{DATA:process} .*\n%{DATA:description}\n%{DATA:state}\n"
-
-      -- local function runs systemctl, parses output and deconstructs dict from grok
-      LET serviceDetails(name) = SELECT pid, process, description, state
-        FROM foreach(
-          row= { SELECT grok(data=stdout, grok=pattern) AS parsed
-                 FROM execve(argv=["systemctl", "show", name, "--value", "--property=ExecMainPID,ExecStart,Description,ActiveState"]) },
-          column="parsed")
+      LET serviceDetails(name) = SELECT
+        ExecMainPID, ExecStart, Description, ActiveState
+      FROM systemctl(command="show", unit=name,
+        properties=["ExecStart", "Description", "ExecMainPID", "ActiveState"])
 
       LET serviceStartEvents = SELECT
         timestamp(epoch=REALTIME_TIMESTAMP) AS Timestamp,
@@ -39,9 +31,9 @@ sources:
         Timestamp,
         Service,
         "root" AS User,
-        details.pid AS PID,
-        details.process AS Process,
-        details.description AS Description,
-        details.state AS State
+        details.ExecMainPID AS PID,
+        details.ExecStart AS Process,
+        details.Description AS Description,
+        details.ActiveState AS State
       FROM serviceStartEvents