epylog

epylog@lists.fedorahosted.org

339 discussions

[epylog: 294/297] remove debug output left in by mistake
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 413378e8c3ac98a39d549602667676dcf765d218 Author: Seth Vidal <skvidal(a)fedoraproject.org> Date: Wed Sep 7 11:57:49 2011 -0400 remove debug output left in by mistake modules/logins_mod.py | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) --- diff --git a/modules/logins_mod.py b/modules/logins_mod.py index cd36c1d..1ef398b 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -841,7 +841,6 @@ class logins_mod(InternalModule): report = self.report_wrap % report if self.oldest_to_keep: - print self.oldest_to_keep q = """delete from logins where stamp < ?""" p = (self.oldest_to_keep,) executeSQL(self.db_cx.cursor(), q, p)

1 0

[epylog: 293/297] not quoted, dumbass
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit aed7532e7fa79d70f9b1eec2387197e6e7bd7f0e Author: Seth Vidal <skvidal(a)fedoraproject.org> Date: Tue Sep 6 16:20:53 2011 -0400 not quoted, dumbass etc/modules.d/logins.conf.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/etc/modules.d/logins.conf.in b/etc/modules.d/logins.conf.in index 032dd94..f4f7b26 100644 --- a/etc/modules.d/logins.conf.in +++ b/etc/modules.d/logins.conf.in @@ -42,7 +42,7 @@ systems_collapse = 10 # comma/space separated list of users to ignore - unknown is the internal "no user given" ignore_users = unknown # path to where we keep the logins db -loginsdb_path = '/var/lib/epylog/logins_db.sqlite' +loginsdb_path = /var/lib/epylog/logins_db.sqlite # clean up entries in the db which are more than this many days old remove_older_than = 14 # time fuzz - default time (in minutes) which is valid fuzzy match for a login to not be listed

1 0

[epylog: 292/297] make the logins module use a sqlite db and some fuzzy matching to determine if the user login needs
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 6430768afbde33700b44a30c31bd033c88905a39 Author: Seth Vidal <skvidal(a)fedoraproject.org> Date: Tue Sep 6 16:08:20 2011 -0400 make the logins module use a sqlite db and some fuzzy matching to determine if the user login needs to be reported. This will end up showing only new or 'odd' logins by your users. Signed-off-by: Konstantin Ryabitsev <mricon(a)kernel.org> etc/modules.d/logins.conf.in | 11 ++ modules/logins_mod.py | 237 +++++++++++++++++++++++++++++++++--------- 2 files changed, 200 insertions(+), 48 deletions(-) --- diff --git a/etc/modules.d/logins.conf.in b/etc/modules.d/logins.conf.in index fa5867d..032dd94 100644 --- a/etc/modules.d/logins.conf.in +++ b/etc/modules.d/logins.conf.in @@ -20,6 +20,7 @@ enable_dovecot = 0 enable_courier = 0 enable_imp = 0 enable_proftpd = 0 + ## # This is a fun setting. You can list domains that are "safe" here. # E.g. if your org's domain is example.com and you generally don't @@ -37,3 +38,13 @@ safe_domains = .* # If you have too many systems, wide-scale probing may turn ugly. This # will collapse the reports. systems_collapse = 10 + +# comma/space separated list of users to ignore - unknown is the internal "no user given" +ignore_users = unknown +# path to where we keep the logins db +loginsdb_path = '/var/lib/epylog/logins_db.sqlite' +# clean up entries in the db which are more than this many days old +remove_older_than = 14 +# time fuzz - default time (in minutes) which is valid fuzzy match for a login to not be listed +time_fuzz = 60 + diff --git a/modules/logins_mod.py b/modules/logins_mod.py index 34b45c6..cd36c1d 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -1,3 +1,5 @@ + + #!/usr/bin/python -tt """ Description will eventually go here. @@ -28,10 +30,26 @@ Description will eventually go here. import sys import re - +import time +import os +import sqlite3 as sqlite sys.path.insert(0, '../py/') from epylog import Result, InternalModule + +def executeSQL(cursor, query, params=None): + """ + Execute a python 2.5 (sqlite3) style query. + + @param cursor: A sqlite cursor + @param query: The query to execute + @param params: An optional list of parameters to the query + """ + if params is None: + return cursor.execute(query) + + return cursor.execute(query, params) + class logins_mod(InternalModule): def __init__(self, opts, logger): InternalModule.__init__(self) @@ -49,7 +67,19 @@ class logins_mod(InternalModule): # self.pam_ignore = ['crond'] self.xinetd_ignore = [] - + self.logins_db = opts.get('loginsdb_path', '/var/lib/epylog/logins_db.sqlite') # where to keep the loginsdb + self.time_fuzz = int(opts.get('time_fuzz', 60)) # how much to fuzz the time in minutes (default 60m) + remove_older_than = int(opts.get('remove_older_than', 14)) # time in days to start remove from the db + self.oldest_to_keep = time.time() - (remove_older_than*86400) + if remove_older_than == '0': # if it is zero then don't delete any, ever - hah your funeral + self.oldest_to_keep = None + + ig_users = opts.get('ignore_users', '') + ig_users.replace(',',' ') + self.ignore_users = ig_users.split(' ') + + self.db_cx = None + ## # PAM reports # @@ -255,7 +285,7 @@ class logins_mod(InternalModule): mo = self.pam_failure_more_re.search(message) if mo: mult += int(mo.group(1)) restuple = self._mk_restuple(action, system, service, user, - byuser, rhost) + byuser, rhost, linemap['stamp']) return {restuple: mult} def pam_open(self, linemap): @@ -274,7 +304,7 @@ class logins_mod(InternalModule): return None user, byuser, byuid = mo.groups() if byuser == '': byuser = self.getuname(int(byuid)) - restuple = self._mk_restuple(action, system, service, user, byuser, '') + restuple = self._mk_restuple(action, system, service, user, byuser, '', linemap['stamp']) return {restuple: mult} def pam_baduser(self, linemap): @@ -286,7 +316,7 @@ class logins_mod(InternalModule): return None user = mo.group(1) service = self._get_pam_service(message) - restuple = self._mk_restuple(action, system, service, user, '', '') + restuple = self._mk_restuple(action, system, service, user, '', '', linemap['stamp']) return {restuple: mult} def pam_chelper_failure(self, linemap): @@ -298,7 +328,7 @@ class logins_mod(InternalModule): return None user = mo.group(1) service = self._get_pam_service(message) - restuple = self._mk_restuple(action, system, service, user, '', '') + restuple = self._mk_restuple(action, system, service, user, '', '', linemap['stamp']) return {restuple: mult} def pam_krb5_open(self, linemap): @@ -316,7 +346,7 @@ class logins_mod(InternalModule): # result = self.general_ignore(linemap) return result - restuple = self._mk_restuple(action, system, service, user, '', '') + restuple = self._mk_restuple(action, system, service, user, '', '', linemap['stamp']) return {restuple: mult} def pam_krb5_failure(self, linemap): @@ -338,7 +368,7 @@ class logins_mod(InternalModule): # result = self.general_ignore(linemap) return result - restuple = self._mk_restuple(action, system, service, user, '', '') + restuple = self._mk_restuple(action, system, service, user, '', '', linemap['stamp']) return {restuple: mult} def xinetd_start(self, linemap): @@ -355,7 +385,7 @@ class logins_mod(InternalModule): # result = self.general_ignore(linemap) return result - restuple = self._mk_restuple(action, system, service, '', '', '') + restuple = self._mk_restuple(action, system, service, '', '', '', linemap['stamp']) return {restuple: mult} def sshd_open(self, linemap): @@ -374,7 +404,7 @@ class logins_mod(InternalModule): if not service: service = 'ssh1' service = '%s(%s)' % (service, method) restuple = self._mk_restuple(action, system, service, user, - ruser, rhost) + ruser, rhost, linemap['stamp']) return {restuple: mult} def sshd_failure(self, linemap): @@ -389,7 +419,7 @@ class logins_mod(InternalModule): rhost = self.gethost(rhost) if not service: service = 'ssh1' service = '%s(%s)' % (service, method) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def uw_imap_failure(self, linemap): @@ -403,7 +433,7 @@ class logins_mod(InternalModule): return None user, rhost = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def uw_imap_open(self, linemap): @@ -417,7 +447,7 @@ class logins_mod(InternalModule): return None user, rhost = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def dovecot_open(self, linemap): @@ -430,7 +460,7 @@ class logins_mod(InternalModule): return None user, rhost = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def dovecot_failure(self, linemap): @@ -444,7 +474,7 @@ class logins_mod(InternalModule): rhost = mo.group(1) rhost = self.gethost(rhost) user = 'unknown' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def courier_open(self, linemap): @@ -457,7 +487,7 @@ class logins_mod(InternalModule): service, user, rhost = mo.groups() service = '%s(cr)' % service rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def courier_failure(self, linemap): @@ -471,7 +501,7 @@ class logins_mod(InternalModule): service = '%s(cr)' % service rhost = self.gethost(rhost) user = 'unknown' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def proftpd_open(self, linemap): @@ -484,7 +514,7 @@ class logins_mod(InternalModule): service = 'ftp(pro)' rhost, user = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def proftpd_failure(self, linemap): @@ -497,7 +527,7 @@ class logins_mod(InternalModule): service = 'ftp(pro)' rhost, user = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def imp2_failure(self, linemap): @@ -510,7 +540,7 @@ class logins_mod(InternalModule): rhost, system, user = mo.groups() rhost = self.gethost(rhost) service = 'IMP2' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def imp2_open(self, linemap): @@ -523,7 +553,7 @@ class logins_mod(InternalModule): rhost, system, user = mo.groups() rhost = self.gethost(rhost) service = 'IMP2' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def imp3_failure(self, linemap): @@ -536,7 +566,7 @@ class logins_mod(InternalModule): rhost, system, user = mo.groups() rhost = self.gethost(rhost) service = 'IMP3' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def imp3_open(self, linemap): @@ -549,7 +579,7 @@ class logins_mod(InternalModule): user, rhost, system = mo.groups() rhost = self.gethost(rhost) service = 'IMP3' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def cyrus_failure(self,linemap): @@ -562,7 +592,7 @@ class logins_mod(InternalModule): return None rhost, user = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def cyrus_open(self,linemap): @@ -575,7 +605,7 @@ class logins_mod(InternalModule): return None rhost, user = mo.groups() rhost = self.gethost(rhost) - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} def qpopper_failure(self, linemap): @@ -588,9 +618,9 @@ class logins_mod(InternalModule): user, rhost = mo.groups() rhost = self.gethost(rhost) service = 'qpopper' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} - + def qpopper_open(self, linemap): action = self.open system, message, mult = self.get_smm(linemap) @@ -601,17 +631,17 @@ class logins_mod(InternalModule): user, rhost = mo.groups() rhost = self.gethost(rhost) service = 'qpopper' - restuple = self._mk_restuple(action, system, service, user, '', rhost) + restuple = self._mk_restuple(action, system, service, user, '', rhost, linemap['stamp']) return {restuple: mult} ## # HELPER METHODS # - def _mk_restuple(self, action, system, service, user, byuser, rhost): + def _mk_restuple(self, action, system, service, user, byuser, rhost, stamp): if user == '': user = 'unknown' if user == 'root' or user == 'ROOT': action += 10 remote = self._mk_userat(byuser, rhost) - restuple = (action, system, service, remote) + restuple = (action, system, service, remote, stamp) else: if rhost: match = 0 @@ -622,7 +652,7 @@ class logins_mod(InternalModule): if not match: tmp = {'system': system, 'rhost': rhost} system = self.untrusted_host % tmp - restuple = (action, user, service, system) + restuple = (action, user, service, system, stamp) return restuple def _mk_dots(self, str, lim): @@ -656,6 +686,69 @@ class logins_mod(InternalModule): if mo: service = mo.group(1) return service + + + def _check_for_login(self, username, service, hostname, tid): + # check if we have a login which matches in the db, + + if not os.path.exists(self.logins_db): + return False + + p = (username, service, hostname, self.last_entry) + q = "select * from logins where username=? and service=? and host=? and pkey <= ?" + if not self.db_cx: + self._db_cx() + + cur = self.db_cx.cursor() + ob = executeSQL(cur, q, p) + for i in ob: + # if we get any matches if they match within the fuzzed time then + # don't show it + if abs(tid - i[7]) <= self.time_fuzz: + return True + return False + + def _add_login(self, username, action, hostname, timestamp, service, u_from=None): + if not self.db_cx: + self._db_cx() + + cur = self.db_cx.cursor() + t_st = time.localtime(int(timestamp)) + time_in_day = int(t_st[3]*60) + int(t_st[4]) + q = "insert into logins values (NULL, ?, ?, ?, ?, ?, ?, ?)" + p = (action, username, hostname, u_from, service, timestamp, time_in_day) + cur.execute(q, p) + + + def _db_cx(self): + if not os.path.exists(self.logins_db): + self.db_cx = self._setup_logins_db() + else: + self.db_cx = sqlite.Connection(self.logins_db) + + q = "select max(pkey) from logins" + last_e = executeSQL(self.db_cx.cursor(), q) + val = last_e.fetchone()[0] + if not val: + self.last_entry = 0 + else: + self.last_entry = val + + def _setup_logins_db(self): + schema = [ + """PRAGMA synchronous="OFF";""", + """CREATE TABLE logins ( pkey INTEGER PRIMARY KEY, action INTEGER, + username TEXT, host TEXT, u_from TEXT, service TEXT, + stamp INTEGER, time_in_day INTEGER);""", + ] + + cx = sqlite.Connection(self.logins_db) + cursor = cx.cursor() + for cmd in schema: + executeSQL(cursor, cmd) + + return cx + ## # FINALIZE!! # @@ -666,31 +759,71 @@ class logins_mod(InternalModule): # report = '' rep = {} + + # FIXME + # go through each item in the rs + # feed them into the db + # pull back from the db all the info you need for the report + # simplifies a lot of this code + + # chuck it all into the db + for (rt,count) in rs.items(): + if rt[0] in (self.root_failure, self.root_open): + (action, host, service, remote, stamp) = rt + user = 'root' + elif rt[0] in (self.open, self.failure): + (action, user, service, host, stamp) = rt + remote = 'NULL' + else: + continue + if user in self.ignore_users: + continue + for num in range(0, count): + self._add_login(user, action, host, stamp, service, remote) + self.db_cx.commit() + + #return "lalallala" + for action in [self.root_failure, self.root_open, self.failure, self.open]: rep[action] = '' + per_user = {} flipper = '' - for key in rs.get_distinct((action,)): + q = """select distinct username, service, host from logins where action = ? and pkey > ?""" + p = (action, self.last_entry) + act_tuple = [(i[0],i[1], i[2]) for i in executeSQL(self.db_cx.cursor(), q, p)] + + for entry in act_tuple: + username = entry[0] + if username not in per_user: + per_user[username] = {} + service = entry[1] + if service not in per_user[username]: + per_user[username][service] = [] + hn = entry[2] + q = """select time_in_day from logins where username = ? and host = ? and service = ? and action = ? and pkey > ?""" + p = (username, hn, service, action, self.last_entry) + + this_logins_times = [row[0] for row in executeSQL(self.db_cx.cursor(), q, p)] + count = 0 + for t in this_logins_times: + if not self._check_for_login(username, service, hn, t): + # DEBUG print 'new login %s %s %s %s' % (username, service, hn, t) + count += 1 + + if count: + per_user[username][service].append('%s(%d)' % (hn, count)) + + blank = 0 + for username in sorted(per_user): if flipper: flipper = '' else: flipper = self.flip - service_rep = [] - for service in rs.get_distinct((action, key)): - mymap = rs.get_submap((action, key, service)) - key2s = [] - for key2 in mymap.keys(): - loghost = key2[0] - key2s.append('%s(%d)' % (loghost, mymap[key2])) - if len(key2s) > self.systems_collapse: - loghosts = self.collapsed_rep % (key2s[0],len(key2s)-1) - else: - loghosts = ', '.join(key2s) - service_rep.append([service, loghosts]) - blank = 0 - for svcrep in service_rep: + for (svc,reps) in per_user[username].items(): if blank: key = ' ' else: blank = 1 - rep[action] += self.line_rep % (flipper, key, - svcrep[0], svcrep[1]) + if reps: + rep[action] += self.line_rep % (flipper, username, + svc, ', '.join(reps)) if rep[self.root_failure]: report += self.subreport_wrap % (self.root_failures_title, @@ -706,6 +839,14 @@ class logins_mod(InternalModule): rep[self.open]) report = self.report_wrap % report + + if self.oldest_to_keep: + print self.oldest_to_keep + q = """delete from logins where stamp < ?""" + p = (self.oldest_to_keep,) + executeSQL(self.db_cx.cursor(), q, p) + self.db_cx.commit() + return report if __name__ == '__main__':

1 0

[epylog: 291/297] add common_unparsed strings module add module config file modify weeder config to run, by default, b
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit d9e2bccb2b869c599e7cefd5223a2c8581f92601 Author: Seth Vidal <skvidal(a)fedoraproject.org> Date: Thu Aug 25 11:08:08 2011 -0400 add common_unparsed strings module add module config file modify weeder config to run, by default, before common_unparsed strings Signed-off-by: Konstantin Ryabitsev <mricon(a)kernel.org> etc/modules.d/common_unparsed.conf.in | 12 ++++ etc/modules.d/weeder.conf.in | 2 +- modules/common_unparsed_mod.py | 115 +++++++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 1 deletions(-) --- diff --git a/etc/modules.d/common_unparsed.conf.in b/etc/modules.d/common_unparsed.conf.in new file mode 100644 index 0000000..71a0620 --- /dev/null +++ b/etc/modules.d/common_unparsed.conf.in @@ -0,0 +1,12 @@ +[module] +desc = Common Unparsed Similar Strings Module +exec = %%MODULES_DIR%%/common_unparsed_mod.py +files = /var/log/messages[.#] /var/log/secure[.#] +enabled = yes +internal = yes +outhtml = yes +priority = 10 + +[conf] +# how similar the strings need to be 0-100 - 0 being not at all (bad idea) 100 being almost exactly. +match_percentage = 95 diff --git a/etc/modules.d/weeder.conf.in b/etc/modules.d/weeder.conf.in index 46c836e..0fbe8fe 100644 --- a/etc/modules.d/weeder.conf.in +++ b/etc/modules.d/weeder.conf.in @@ -5,7 +5,7 @@ files = /var/log/messages[.#], /var/log/secure[.#], /var/log/maillog[.#] enabled = yes internal = yes outhtml = yes -priority = 10 +priority = 9 [conf] ## diff --git a/modules/common_unparsed_mod.py b/modules/common_unparsed_mod.py new file mode 100644 index 0000000..1b1e651 --- /dev/null +++ b/modules/common_unparsed_mod.py @@ -0,0 +1,115 @@ +#!/usr/bin/python -tt +""" +This module should run after all other modules. + +Takes the remaining logs, saves them out to a tmpfile. +Uses difflib.SequenceMatcher() to return logs which occur most often and are +at least a set percentage similar. This lets you catch logs which are +from multiple machines and more or less the same or similar logs (with memory +or process id offsets) from the same machine. + +""" + +import sys +import re +import difflib +from operator import itemgetter +import tempfile +import os +import shutil + +## +# This is for testing purposes, so you can invoke this from the +# modules directory. See also the testing notes at the end of the +# file. +# +sys.path.insert(0, '../py/') +from epylog import Result, InternalModule + +class common_unparsed_mod(InternalModule): + def __init__(self, opts, logger): + InternalModule.__init__(self) + self.logger = logger + rc = re.compile + + self.match_percentage = int(opts.get('match_percentage', '95')) + self.debug_dump = int(opts.get('debug_dump', '0')) + self.regex_map = {rc('^.+$'):self.expand_out_line} + self.tmpdir = tempfile.mkdtemp(prefix='epylog-common-unparsed', dir='/var/tmp') + self.matchfile = self.tmpdir + '/match_limited' + self.matchfile_f = open(self.matchfile, 'w') + self.complete = self.tmpdir + '/complete' + self.complete_f = open(self.complete, 'w') + + + ## + # Line-matching routines + # + def expand_out_line(self, linemap): + sys, msg, mult = self.get_smm(linemap) + matchout = '%s\n' % (msg) + com_out = '%s' % (linemap['line']) + for i in range(0, int(mult)): + self.complete_f.write(com_out) + self.matchfile_f.write(matchout) + + #dirty like zebra + if not os.path.exists(self.tmpdir + '/returned'): + open(self.tmpdir + '/returned', 'w').close() + return {'match':0} + else: + return None + + + def finalize(self, rs): + self.complete_f.close() + self.matchfile_f.close() + matches = {} + full_matches = {} + lines_matched = set() + where = 0 + rl = open(self.matchfile, 'r') + for l in rl: + where += 1 + sub_where = 0 + for ol in open(self.matchfile, 'r'): + sub_where += 1 + if sub_where < where: # if we're before it in the file we've already matched it + continue + if sub_where in lines_matched: + continue + + c = difflib.SequenceMatcher(isjunk=lambda x: x in ('1','2','3','4','5','6','7','8','9','0'),a=l, b=ol) + rq_ratio = int(c.real_quick_ratio()*100) # do the fast upper bound - find out if we should even glance at it. + if rq_ratio < 60: + continue + ratio = int(c.ratio()*100) + if ratio >= self.match_percentage: + lines_matched.add(sub_where) + if l not in matches: + matches[l] = 0 + full_matches[l] = [] + matches[l] += 1 + full_matches[l].append((ol,ratio)) + if self.debug_dump: + fm_db = open(self.tmpdir + '/debug-match', 'w') + for k in full_matches: + fm_db.write(k) + for (v,r) in full_matches[k]: + fm_db.write(' %s %s' % (r, v)) + fm_db.close() + + res = "<table border=0><tr><th>Count</th><th align=left>Log</th></tr>\n\n" + for (k,v) in sorted(matches.items(), key=itemgetter(1), reverse=True)[:20]: # take the top 20 most common provided there are more than 1 + if v > 1: + res += "<tr>\n<td bgcolor='#DDDDDD'>%s</td><td>%s</td>\n</tr>" % (v, k) + res += "<tr>\n<td colspan=2>\n<h2>Complete messages</h2>\n<pre>\n" + res += ''.join(sorted(open(self.complete, 'r').readlines())) + res += "</pre>\n</td>\n</tr>\n</table>" + return res + + + +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(common_unparsed_mod, sys.argv)

1 0

[epylog: 290/297] add rsyncd module
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit ac1d87a876ae1fc1b87e2935c594a8f2d765becb Author: Seth Vidal <skvidal(a)fedoraproject.org> Date: Wed Aug 24 17:04:39 2011 -0400 add rsyncd module etc/modules.d/rsyncd.conf.in | 15 +++ modules/rsyncd_mod.py | 219 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 234 insertions(+), 0 deletions(-) --- diff --git a/etc/modules.d/rsyncd.conf.in b/etc/modules.d/rsyncd.conf.in new file mode 100644 index 0000000..a271f13 --- /dev/null +++ b/etc/modules.d/rsyncd.conf.in @@ -0,0 +1,15 @@ +[module] +desc = Rsyncd +exec = %%MODULES_DIR%%/rsyncd_mod.py +files = /var/log/messages[.#] +enabled = no +internal = yes +outhtml = yes +priority = 7 + +[conf] +## +# Report this many "top ranking hosts" +# +report_top = 10 +# ignore_hosts = list of dns-resolved host names you want to ignore rsyncs on diff --git a/modules/rsyncd_mod.py b/modules/rsyncd_mod.py new file mode 100644 index 0000000..5ec899c --- /dev/null +++ b/modules/rsyncd_mod.py @@ -0,0 +1,219 @@ +#!/usr/bin/python -tt +""" +Rsyncd log parsing module for Epylog +""" + +## +# Copyright (C) 2003 by Duke University +# Written by Seth Vidal <skvidal at phy.duke.edu> +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA +# 02111-1307, USA. +# + + +import sys +import re + +## +# This is for testing purposes, so you can invoke this from the +# modules directory. See also the testing notes at the end of the +# file. +# +sys.path.insert(0, '../py/') +from epylog import Result, InternalModule + +class rsyncd_mod(InternalModule): + ## + # opts: is a map with extra options set in + # [conf] section of the module config, or on the + # command line using -o flag to the module. + # logger: A logging object. API: + # logger.put(loglvl, 'Message') + # Only critical stuff needs to go onto lvl 0. + # Common output goes to lvl 1. + # Others are debug levels. + # + def __init__(self, opts, logger): + ## + # Do a "super-init" so the class we are subclassing gets + # instantiated. + # + InternalModule.__init__(self) + self.logger = logger + ## + # Convenience + # + rc = re.compile + + self.regex_map = { + rc('rsyncd\[\d+\]: rsync on'): self.rsync_hosts, + rc('rsyncd\[\d+\]: (?:sent|wrote)\s\S*\sbytes'): self.rsync_results + } + self.topcount = int(opts.get('report_top', 5)) #get report_top, default to 5 if not set + ig_s = opts.get('ignore_hosts', '') + ig_s.replace(',',' ') + self.ignore_hosts = ig_s.split(' ') + # dict to store all of our data + self.rsync_pid_bytes = {} + self.rsync_pid_host = {} + self.rsync_host_loc = rc('rsyncd\[(\d+)\]: rsync\son\s(\S*)\sfrom\s.*$(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$') + self.rsync_bytes = rc('rsyncd\[(\d+)\]: (?:sent|wrote)\s(\d+) bytes (?:read|received)\s(\d+) bytes total size (\d+)') + + def rsync_hosts(self, linemap): + (sys, msg, multi) = self.get_smm(linemap) + pid, loc, ip = self.rsync_host_loc.search(msg).groups() + host = self.gethost(ip) + if host not in self.ignore_hosts: + self.rsync_pid_host[pid] = (host, loc) + return {(loc, host): 1} + + def rsync_results(self, linemap): + (sys, msg, multi) = self.get_smm(linemap) + pid, wbytes, rbytes, tbytes = self.rsync_bytes.search(msg).groups() + self.rsync_pid_bytes[pid] = (wbytes, rbytes, tbytes) + return {(pid, wbytes): 1} + + def _uniq(self, s): + """Return a list of the elements in s, but without duplicates. + + For example, unique([1,2,3,1,2,3]) is some permutation of [1,2,3], + unique("abcabc") some permutation of ["a", "b", "c"], and + unique(([1, 2], [2, 3], [1, 2])) some permutation of + [[2, 3], [1, 2]]. + + For best speed, all sequence elements should be hashable. Then + unique() will usually work in linear time. + + If not possible, the sequence elements should enjoy a total + ordering, and if list(s).sort() doesn't raise TypeError it's + assumed that they do enjoy a total ordering. Then unique() will + usually work in O(N*log2(N)) time. + + If that's not possible either, the sequence elements must support + equality-testing. Then unique() will usually work in quadratic + time. + """ + + n = len(s) + if n == 0: + return [] + + # Try using a dict first, as that's the fastest and will usually + # work. If it doesn't work, it will usually fail quickly, so it + # usually doesn't cost much to *try* it. It requires that all the + # sequence elements be hashable, and support equality comparison. + u = {} + try: + for x in s: + u[x] = 1 + except TypeError: + del u # move on to the next method + else: + return u.keys() + + # We can't hash all the elements. Second fastest is to sort, + # which brings the equal elements together; then duplicates are + # easy to weed out in a single pass. + # NOTE: Python's list.sort() was designed to be efficient in the + # presence of many duplicate elements. This isn't true of all + # sort functions in all languages or libraries, so this approach + # is more effective in Python than it may be elsewhere. + try: + t = list(s) + t.sort() + except TypeError: + del t # move on to the next method + else: + assert n > 0 + last = t[0] + lasti = i = 1 + while i < n: + if t[i] != last: + t[lasti] = last = t[i] + lasti += 1 + i += 1 + return t[:lasti] + + # Brute force is all that's left. + u = [] + for x in s: + if x not in u: + u.append(x) + return u + + def _sortByVal(self, dict, reverse=0): + if type(dict) is not type({}): return [] + keys = dict.keys() + s = map(lambda k: (dict[k], k), keys) + s.sort() + if reverse: s.reverse() + return s + + def finalize(self, resultset): + ## + # A resultset is a dictionary of all values returned by your + # handler functions -- except they are unique and show how many + # times each tuple occurs. + # See epylog.Result for some convenience methods to use when + # processing and analyzing the results. + # + + hostloc = {} # key = host, val = [loc, loc, loc] + hosttotal = {} # key = host val = totalwbytes + + foo = "<table border=0>\n\t<tr>\n" + + for pid in self.rsync_pid_host.keys(): + (host, loc) = self.rsync_pid_host[pid] + if self.rsync_pid_bytes.has_key(pid): + if not hostloc.has_key(host): + hostloc[host] = [] + if not hosttotal.has_key(host): + hosttotal[host] = 0L + hostloc[host].append(loc) + bytes = long(self.rsync_pid_bytes[pid][0]) + hosttotal[host] += bytes + + for host in hostloc.keys(): + hostloc[host] = self._uniq(hostloc[host]) + + hosts = self._sortByVal(hosttotal, 1) + count = 0L + for (tot,host) in hosts[:self.topcount]: + if count % 2: + bgcolor = "#dddddd" + else: + bgcolor = "#ffffff" + count+=1 + line = '\t\t<td bgcolor=%s valign=\"top\">%s</td>\n' % (bgcolor, host) + line = line + '\t\t<td bgcolor=%s valign="top">\n' % bgcolor + for loc in hostloc[host]: + line = line + '\t\t\t%s<br>\n' % loc + line = line + '\t\t</td>\n' + size, marker = self.mk_size_unit(hosttotal[host]) + line = line + '\t\t<td bgcolor=%s valign="top">%s%s</td>\n' % (bgcolor, size, marker) + line = line + '\t</tr>\n' + foo = foo + line + foo = foo + '</table>\n' + return foo + +## +# This is useful when testing your module out. +# Invoke without command-line parameters to learn about the proper +# invocation. +# +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(rsyncd_mod, sys.argv)

1 0

[epylog: 289/297] Fixed mixed tab and whitespace-errors
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 817a144712ecb112298079262d79b15f9c68e60d Author: Micha vor dem Berge <m(a)mcvdb.de> Date: Fri Jan 29 13:49:06 2010 +0000 Fixed mixed tab and whitespace-errors modules/selinux_mod.py | 30 +++++++++++++++------------- modules/sudo_mod.py | 49 ++++++++++++++++++++++++----------------------- modules/yum_mod.py | 28 +++++++++++++------------- 3 files changed, 55 insertions(+), 52 deletions(-) --- diff --git a/modules/selinux_mod.py b/modules/selinux_mod.py index d603877..0e40b20 100644 --- a/modules/selinux_mod.py +++ b/modules/selinux_mod.py @@ -23,8 +23,8 @@ class selinux_mod(InternalModule): self.logger.put(3, 'initializing selinux') rc = re.compile - self.ignore = 0 - self.preventing = 1 + self.ignore = 0 + self.preventing = 1 selinux_map = { rc('.*setroubleshoot\: SELinux is preventing'): self.selinux @@ -52,30 +52,32 @@ class selinux_mod(InternalModule): # Line-matching routines # def selinux(self, linemap): - action = self.preventing - self.logger.put(3, 'selinux invoked') + action = self.preventing + self.logger.put(3, 'selinux invoked') sys, msg, mult = self.get_smm(linemap) - self.logger.put(3, 'test selinux %d' % mult) + self.logger.put(3, 'test selinux %d' % mult) message = self._get_selinux_message(msg) - self.logger.put(3, 'selinux message: %s' % message) + self.logger.put(3, 'selinux message: %s' % message) restuple = self._mk_restuple(sys, action, message) - self.logger.put(3, 'selinux finished') + self.logger.put(3, 'selinux finished') return {restuple: mult} + ## # Helpers # def _mk_restuple(self, sys, action, message): - return (action, message, sys) + return (action, message, sys) def _get_selinux_message(self, str): - message = 'unknown' + message = 'unknown' mo = self.selinux_message_re.search(str) if mo: message = mo.group(1) return message + #### # Finalize the report def finalize(self, rs): @@ -95,15 +97,15 @@ class selinux_mod(InternalModule): else: flipper = self.flip service_rep = [] - for system in rs.get_distinct((action, message,)): - service_rep.append(system) + for system in rs.get_distinct((action, message,)): + service_rep.append(system) - system_list = ', '.join(service_rep) - rep[action] += self.line_rep % (flipper, message, system_list) + system_list = ', '.join(service_rep) + rep[action] += self.line_rep % (flipper, message, system_list) if rep[self.preventing]: report += self.subreport_wrap % (self.selinux_preventing_title, rep[self.preventing]) - logger.put(3, 'selinux report: self.preventing added') + logger.put(3, 'selinux report: self.preventing added') report = self.report_wrap % report return report diff --git a/modules/sudo_mod.py b/modules/sudo_mod.py index 786e3bf..d411b9f 100644 --- a/modules/sudo_mod.py +++ b/modules/sudo_mod.py @@ -23,9 +23,9 @@ class sudo_mod(InternalModule): self.logger.put(2, 'initializing sudo') rc = re.compile - self.ignore = 0 - self.open = 1 - self.not_allowed = 2 + self.ignore = 0 + self.open = 1 + self.not_allowed = 2 sudo_map = { rc('.*sudo\:\s+\S+\s\:\sTTY'): self.sudo, @@ -61,20 +61,20 @@ class sudo_mod(InternalModule): # Line-matching routines # def sudo(self, linemap): - action = self.open - self.logger.put(2, 'sudo invoked') + action = self.open + self.logger.put(2, 'sudo invoked') sys, msg, mult = self.get_smm(linemap) - self.logger.put(3, 'test sudo %d' % mult) + self.logger.put(3, 'test sudo %d' % mult) user = self._get_sudo_user(msg) - self.logger.put(3, 'sudo user: %s' % user) - asuser = self._get_sudo_as_user(msg) - self.logger.put(3, 'sudo asuser: %s' % asuser) - command_name = self._get_sudo_command_name(msg) - self.logger.put(3, 'sudo command: %s' % command_name) + self.logger.put(3, 'sudo user: %s' % user) + asuser = self._get_sudo_as_user(msg) + self.logger.put(3, 'sudo asuser: %s' % asuser) + command_name = self._get_sudo_command_name(msg) + self.logger.put(3, 'sudo command: %s' % command_name) restuple = self._mk_restuple(sys, action, user, asuser, command_name, None) - self.logger.put(2, 'sudo finished') + self.logger.put(2, 'sudo finished') return {restuple: mult} def sudo_na(self, linemap): @@ -89,7 +89,7 @@ class sudo_mod(InternalModule): self.logger.put(3, 'sudo asuser: %s' % asuser) command_name = self._get_sudo_command_name(msg) self.logger.put(3, 'sudo command: %s' % command_name) - error_message = self._get_sudo_error_message(msg) + error_message = self._get_sudo_error_message(msg) self.logger.put(3, 'sudo error_message: %s' % error_message) restuple = self._mk_restuple(sys, action, user, asuser, command_name, error_message) @@ -97,30 +97,30 @@ class sudo_mod(InternalModule): return {restuple: mult} def sudo_ignore(self, linemap): - restuple = self._mk_restuple(None, self.ignore, None, None, None, None) - return {restuple: 1} + restuple = self._mk_restuple(None, self.ignore, None, None, None, None) + return {restuple: 1} ## - # HElpers + # Helpers # def _mk_restuple(self, sys, action, user=None, asuser=None, command_name=None, error_message=None): - return (action, user, command_name, asuser, error_message, sys) + return (action, user, command_name, asuser, error_message, sys) #return (sys, action, user, asuser, command_name) def _get_sudo_user(self, str): - user = 'unknown' + user = 'unknown' mo = self.sudo_user_name_re.search(str) if mo: user = mo.group(1) return user def _get_sudo_as_user(self, str): - asuser = 'unknown' + asuser = 'unknown' mo = self.sudo_as_user_re.search(str) if mo: asuser = mo.group(1) return asuser def _get_sudo_error_message(self, str): - pass_attempts = 0 + pass_attempts = 0 mo = self.sudo_error_message_re.search(str) if mo: pass_attempts = mo.group(1) return pass_attempts @@ -131,6 +131,7 @@ class sudo_mod(InternalModule): if mo: command_name = mo.group(1) return command_name + #### # Finalize the report def finalize(self, rs): @@ -167,19 +168,19 @@ class sudo_mod(InternalModule): #logger.put(2, 'sudo svcrep: %s' % svcrep) if blank: user = ' ' else: blank = 1 - if (action == self.open): + if (action == self.open): rep[action] += self.line_rep % (flipper, user, svcrep[0], svcrep[1], svcrep[2]) - else: + else: rep[action] += self.line_rep_na % (flipper, user, svcrep[0], svcrep[3], svcrep[1], svcrep[2]) if rep[self.open]: report += self.subreport_wrap % (self.sudo_open_title, rep[self.open]) - logger.put(2, 'sudo report: self.open added') + logger.put(2, 'sudo report: self.open added') if rep[self.not_allowed]: report += self.subreport_na_wrap % (self.sudo_not_allowed_title, rep[self.not_allowed]) - logger.put(2, 'sudo report: self.not_allowed added') + logger.put(2, 'sudo report: self.not_allowed added') report = self.report_wrap % report return report diff --git a/modules/yum_mod.py b/modules/yum_mod.py index 0ab5e9d..c6409fc 100644 --- a/modules/yum_mod.py +++ b/modules/yum_mod.py @@ -25,10 +25,10 @@ class yum_mod(InternalModule): self.logger = logger rc = re.compile - self.ignore = 0 - self.installed = 1 - self.updated = 2 - self.erased = 3 + self.ignore = 0 + self.installed = 1 + self.updated = 2 + self.erased = 3 yum_map = { rc('yum\: Installed\:'): self.pkg_installed, @@ -64,12 +64,12 @@ class yum_mod(InternalModule): # def pkg_updated(self, linemap): self.logger.put(3, 'entered pkg_updated...') - action = self.updated + action = self.updated sys, msg, mult = self.get_smm(linemap) - self.logger.put(3, 'test yum %d' % mult) - name = self._get_updated_name(msg) - self.logger.put(3, 'name: %s' % name) + self.logger.put(3, 'test yum %d' % mult) + name = self._get_updated_name(msg) + self.logger.put(3, 'name: %s' % name) restuple = self._mk_restuple(action, sys, name) return {restuple: mult} @@ -103,10 +103,10 @@ class yum_mod(InternalModule): # Helpers # def _mk_restuple(self, action, sys, name=None): - return (action, sys, name) + return (action, sys, name) def _get_name(self, str): - name = 'unknown' + name = 'unknown' mo = self.name_re.search(str) if mo: name = mo.group(1) return name @@ -136,7 +136,7 @@ class yum_mod(InternalModule): # report = '' rep = {} - # (action, sys, name) + # (action, sys, name) for action in [self.updated, self.installed, self.erased]: rep[action] = '' flipper = '' @@ -146,10 +146,10 @@ class yum_mod(InternalModule): else: flipper = self.flip service_rep = [] - for name in rs.get_distinct((action, system,)): - service_rep.append(name) + for name in rs.get_distinct((action, system,)): + service_rep.append(name) - user_list = ', '.join(service_rep) + user_list = ', '.join(service_rep) rep[action] += self.line_rep % (flipper, system, user_list) if rep[self.installed]:

1 0

[epylog: 288/297] adding yum, sudo, selinux modules and configuration files
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 2ce7241c750e85a881e3b811f8c9805709cca8a3 Author: Jeremy Kindy <kindyjd(a)wfu.edu> Date: Wed Jan 27 15:42:52 2010 +0000 adding yum, sudo, selinux modules and configuration files etc/modules.d/selinux.conf.in | 11 +++ etc/modules.d/sudo.conf.in | 11 +++ etc/modules.d/yum.conf.in | 11 +++ modules/selinux_mod.py | 114 ++++++++++++++++++++++++ modules/sudo_mod.py | 190 +++++++++++++++++++++++++++++++++++++++++ modules/yum_mod.py | 170 ++++++++++++++++++++++++++++++++++++ 6 files changed, 507 insertions(+), 0 deletions(-) --- diff --git a/etc/modules.d/selinux.conf.in b/etc/modules.d/selinux.conf.in new file mode 100644 index 0000000..9659438 --- /dev/null +++ b/etc/modules.d/selinux.conf.in @@ -0,0 +1,11 @@ +[module] +desc = SELinux Report +exec = %%MODULES_DIR%%/selinux_mod.py +files = /var/log/messages[.#] +enabled = yes +internal = yes +outhtml = yes +priority = 5 + +[conf] +enable_selinux = 1 diff --git a/etc/modules.d/sudo.conf.in b/etc/modules.d/sudo.conf.in new file mode 100644 index 0000000..4f01be1 --- /dev/null +++ b/etc/modules.d/sudo.conf.in @@ -0,0 +1,11 @@ +[module] +desc = Sudo Report +exec = %%MODULES_DIR%%/sudo_mod.py +files = /var/log/secure[.#] +enabled = yes +internal = yes +outhtml = yes +priority = 5 + +[conf] +enable_sudo = 1 diff --git a/etc/modules.d/yum.conf.in b/etc/modules.d/yum.conf.in new file mode 100644 index 0000000..13eeedb --- /dev/null +++ b/etc/modules.d/yum.conf.in @@ -0,0 +1,11 @@ +[module] +desc = Yum Report +exec = %%MODULES_DIR%%/yum_mod.py +files = /var/log/messages[.#] +enabled = yes +internal = yes +outhtml = yes +priority = 5 + +[conf] +enable_yum = 1 diff --git a/modules/selinux_mod.py b/modules/selinux_mod.py new file mode 100644 index 0000000..d603877 --- /dev/null +++ b/modules/selinux_mod.py @@ -0,0 +1,114 @@ +#!/usr/bin/python -tt +""" +Reports on selinux messages + +Jeremy Kindy (kindyjd at wfu.edu), Wake Forest University +""" + +import sys +import re + +## +# This is for testing purposes, so you can invoke this from the +# modules directory. See also the testing notes at the end of the +# file. +# +sys.path.insert(0, '../py/') +from epylog import Result, InternalModule + +class selinux_mod(InternalModule): + def __init__(self, opts, logger): + InternalModule.__init__(self) + self.logger = logger + self.logger.put(3, 'initializing selinux') + rc = re.compile + + self.ignore = 0 + self.preventing = 1 + + selinux_map = { + rc('.*setroubleshoot\: SELinux is preventing'): self.selinux + } + + do_selinux = int(opts.get('enable_selinux', '1')) + + self.regex_map = {} + if do_selinux: self.regex_map.update(selinux_map) + + self.selinux_message_re = rc('setroubleshoot: (.*). For complete SELinux') + + self.selinux_title = '<font color="blue">SELinux Report</font>' + self.selinux_preventing_title = '<font color="blue">SELinux Prevention Report</font>' + + self.report_wrap = '<table border="0" width="100%%" rules="cols" cellpadding="2">%s</table>' + self.subreport_wrap = '<tr><th colspan="2" align="left"><h3>%s</h3></th></tr>\n%s' + + self.line_rep = '<tr%s><td valign="top" width="25%%">%s</td><td valign="top" width="75%%">%s</td></tr>\n' + + self.flip = ' bgcolor="#dddddd"' + + + ## + # Line-matching routines + # + def selinux(self, linemap): + action = self.preventing + self.logger.put(3, 'selinux invoked') + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test selinux %d' % mult) + message = self._get_selinux_message(msg) + self.logger.put(3, 'selinux message: %s' % message) + + restuple = self._mk_restuple(sys, action, message) + self.logger.put(3, 'selinux finished') + return {restuple: mult} + + ## + # Helpers + # + def _mk_restuple(self, sys, action, message): + return (action, message, sys) + + def _get_selinux_message(self, str): + message = 'unknown' + mo = self.selinux_message_re.search(str) + if mo: message = mo.group(1) + return message + + #### + # Finalize the report + def finalize(self, rs): + logger = self.logger + ## + # Prepare report + # + report = '' + rep = {} + + # (action, message) + for action in [self.preventing]: + rep[action] = '' + flipper = '' + for message in rs.get_distinct((action,)): + if flipper: flipper = '' + else: flipper = self.flip + service_rep = [] + + for system in rs.get_distinct((action, message,)): + service_rep.append(system) + + system_list = ', '.join(service_rep) + rep[action] += self.line_rep % (flipper, message, system_list) + + if rep[self.preventing]: + report += self.subreport_wrap % (self.selinux_preventing_title, rep[self.preventing]) + logger.put(3, 'selinux report: self.preventing added') + + report = self.report_wrap % report + return report + + +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(selinux_mod, sys.argv) diff --git a/modules/sudo_mod.py b/modules/sudo_mod.py new file mode 100644 index 0000000..786e3bf --- /dev/null +++ b/modules/sudo_mod.py @@ -0,0 +1,190 @@ +#!/usr/bin/python -tt +""" +Reports on sudo usage by users. + +Jeremy Kindy (kindyjd at wfu.edu), Wake Forest University +""" + +import sys +import re + +## +# This is for testing purposes, so you can invoke this from the +# modules directory. See also the testing notes at the end of the +# file. +# +sys.path.insert(0, '../py/') +from epylog import Result, InternalModule + +class sudo_mod(InternalModule): + def __init__(self, opts, logger): + InternalModule.__init__(self) + self.logger = logger + self.logger.put(2, 'initializing sudo') + rc = re.compile + + self.ignore = 0 + self.open = 1 + self.not_allowed = 2 + + sudo_map = { + rc('.*sudo\:\s+\S+\s\:\sTTY'): self.sudo, + rc('.*sudo:'): self.sudo_na + } + + do_sudo = int(opts.get('enable_sudo', '1')) + + self.regex_map = {} + if do_sudo: self.regex_map.update(sudo_map) + + self.sudo_user_name_re = rc('sudo:\s*(\S*)') + self.sudo_as_user_re = rc('.*USER=(\S*)\s\;\sCOMMAND') + self.sudo_command_name_re = rc('.*COMMAND=(.*)') + self.sudo_error_message_re = rc('sudo:\s*\S*\s+:\s+(.*)\s+;\s+TTY') + + + self.sudo_title = '<font color="blue">User Sudo Report</font>' + self.sudo_open_title = '<font color="blue">User Sudo Report</font>' + self.sudo_not_allowed_title = '<font color="red">Disallowed Sudo Commands</font>' + + self.report_wrap = '<table border="0" width="100%%" rules="cols" cellpadding="2">%s</table>' + self.subreport_wrap = '<tr><th colspan="5" align="left"><h3>%s</h3></th></tr>\n%s' + self.subreport_na_wrap = '<tr><th colspan="5" align="left"><h3>%s</h3></th></tr>\n%s' + + self.line_rep = '<tr%s><td valign="top" width="15%%">%s</td><td valign="top" width="45%%" colspan="2">%s</td><td width="25%%">%s</td><td width="15%%">%s</td></tr>\n' + self.line_rep_na = '<tr%s><td valign="top" width="15%%">%s</td><td valign="top" width="30%%">%s</td><td valign="top" width="15%%">%s</td><td width="25%%">%s</td><td width="15%%">%s</td></tr>\n' + + self.flip = ' bgcolor="#dddddd"' + + + ## + # Line-matching routines + # + def sudo(self, linemap): + action = self.open + self.logger.put(2, 'sudo invoked') + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test sudo %d' % mult) + user = self._get_sudo_user(msg) + self.logger.put(3, 'sudo user: %s' % user) + asuser = self._get_sudo_as_user(msg) + self.logger.put(3, 'sudo asuser: %s' % asuser) + command_name = self._get_sudo_command_name(msg) + self.logger.put(3, 'sudo command: %s' % command_name) + + restuple = self._mk_restuple(sys, action, user, asuser, command_name, None) + self.logger.put(2, 'sudo finished') + return {restuple: mult} + + def sudo_na(self, linemap): + action = self.not_allowed + self.logger.put(2, 'sudo_na invoked') + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test sudo %d' % mult) + user = self._get_sudo_user(msg) + self.logger.put(3, 'sudo user: %s' % user) + asuser = self._get_sudo_as_user(msg) + self.logger.put(3, 'sudo asuser: %s' % asuser) + command_name = self._get_sudo_command_name(msg) + self.logger.put(3, 'sudo command: %s' % command_name) + error_message = self._get_sudo_error_message(msg) + self.logger.put(3, 'sudo error_message: %s' % error_message) + + restuple = self._mk_restuple(sys, action, user, asuser, command_name, error_message) + self.logger.put(2, 'sudo finished') + return {restuple: mult} + + def sudo_ignore(self, linemap): + restuple = self._mk_restuple(None, self.ignore, None, None, None, None) + return {restuple: 1} + + ## + # HElpers + # + def _mk_restuple(self, sys, action, user=None, asuser=None, command_name=None, error_message=None): + return (action, user, command_name, asuser, error_message, sys) + #return (sys, action, user, asuser, command_name) + + def _get_sudo_user(self, str): + user = 'unknown' + mo = self.sudo_user_name_re.search(str) + if mo: user = mo.group(1) + return user + + def _get_sudo_as_user(self, str): + asuser = 'unknown' + mo = self.sudo_as_user_re.search(str) + if mo: asuser = mo.group(1) + return asuser + + def _get_sudo_error_message(self, str): + pass_attempts = 0 + mo = self.sudo_error_message_re.search(str) + if mo: pass_attempts = mo.group(1) + return pass_attempts + + def _get_sudo_command_name(self, str): + command_name = 'unknown' + mo = self.sudo_command_name_re.search(str) + if mo: command_name = mo.group(1) + return command_name + + #### + # Finalize the report + def finalize(self, rs): + logger = self.logger + ## + # Prepare report + # + report = '' + rep = {} + + # (action, user, command_name, system, error_message) + for action in [self.open, self.not_allowed]: + rep[action] = '' + flipper = '' + for user in rs.get_distinct((action,)): + #logger.put(2, 'sudo user: %s' % user) + if flipper: flipper = '' + else: flipper = self.flip + service_rep = [] + blank = 0 + for command_name in rs.get_distinct((action, user)): + for asuser in rs.get_distinct((action, user, command_name)): + for error_message in rs.get_distinct((action, user, command_name, asuser)): + mymap = rs.get_submap((action, user, command_name, asuser, error_message)) + #logger.put(2, 'sudo command_name: %s' % command_name) + key2s = [] + for key2 in mymap.keys(): + hostname = key2[0] + key2s.append('%s(%d)' % (hostname, mymap[key2])) + hostnames = ', '.join(key2s) + #logger.put(2, 'sudo hostnames: %s' % hostnames) + service_rep.append([command_name, hostnames, asuser, error_message]) + for svcrep in service_rep: + #logger.put(2, 'sudo svcrep: %s' % svcrep) + if blank: user = ' ' + else: blank = 1 + if (action == self.open): + rep[action] += self.line_rep % (flipper, user, svcrep[0], svcrep[1], svcrep[2]) + else: + rep[action] += self.line_rep_na % (flipper, user, svcrep[0], svcrep[3], svcrep[1], svcrep[2]) + + + if rep[self.open]: + report += self.subreport_wrap % (self.sudo_open_title, rep[self.open]) + logger.put(2, 'sudo report: self.open added') + + if rep[self.not_allowed]: + report += self.subreport_na_wrap % (self.sudo_not_allowed_title, rep[self.not_allowed]) + logger.put(2, 'sudo report: self.not_allowed added') + + report = self.report_wrap % report + return report + + +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(sudo_mod, sys.argv) diff --git a/modules/yum_mod.py b/modules/yum_mod.py new file mode 100644 index 0000000..0ab5e9d --- /dev/null +++ b/modules/yum_mod.py @@ -0,0 +1,170 @@ +#!/usr/bin/python -tt +""" +Creates report of packages added via the RedHat yum command. + +Will not catch creations or deletions resulting from direct use of +the rpm command. + +Jeremy Kindy (kindyjd at wfu.edu), Wake Forest University +""" + +import sys +import re + +## +# This is for testing purposes, so you can invoke this from the +# modules directory. See also the testing notes at the end of the +# file. +# +sys.path.insert(0, '../py/') +from epylog import Result, InternalModule + +class yum_mod(InternalModule): + def __init__(self, opts, logger): + InternalModule.__init__(self) + self.logger = logger + rc = re.compile + + self.ignore = 0 + self.installed = 1 + self.updated = 2 + self.erased = 3 + + yum_map = { + rc('yum\: Installed\:'): self.pkg_installed, + rc('yum\: Updated\:'): self.pkg_updated, + rc('yum\: Erased\:'): self.pkg_erased + } + + do_yum = int(opts.get('enable_yum', '1')) + + self.regex_map = {} + if do_yum: self.regex_map.update(yum_map) + + self.name_re = rc('profile\: \[(.*)\]') + self.installed_name_re = rc('Installed\: (.*)') + self.updated_name_re = rc('Updated\: (.*)') + self.erased_name_re = rc('Erased\: (.*)') + + self.yum_title = '<font color="blue">Yum Changes Report</font>' + self.yum_installed_title = '<font color="blue">Packages Installed</font>' + self.yum_updated_title = '<font color="blue">Packages Updated</font>' + self.yum_erased_title = '<font color="blue">Packages Erased</font>' + + self.report_wrap = '<table border="0" width="100%%" rules="cols" cellpadding="2">%s</table>' + self.subreport_wrap = '<tr><th colspan="2" align="left"><h3>%s</h3></th></tr>\n%s' + + self.line_rep = '<tr%s><td valign="top" width="25%%">%s</td><td valign="top" width="75%%">%s</td></tr>\n' + + self.flip = ' bgcolor="#dddddd"' + + + ## + # Line-matching routines + # + def pkg_updated(self, linemap): + self.logger.put(3, 'entered pkg_updated...') + action = self.updated + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test yum %d' % mult) + name = self._get_updated_name(msg) + self.logger.put(3, 'name: %s' % name) + + restuple = self._mk_restuple(action, sys, name) + return {restuple: mult} + + def pkg_installed(self, linemap): + self.logger.put(3, 'entered pkg_installed...') + action = self.installed + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test yum %d' % mult) + name = self._get_installed_name(msg) + self.logger.put(3, 'name: %s' % name) + + restuple = self._mk_restuple(action, sys, name) + return {restuple: mult} + + def pkg_erased(self, linemap): + self.logger.put(3, 'entered pkg_erased...') + action = self.erased + sys, msg, mult = self.get_smm(linemap) + + self.logger.put(3, 'test yum %d' % mult) + name = self._get_erased_name(msg) + self.logger.put(3, 'name: %s' % name) + + restuple = self._mk_restuple(action, sys, name) + return {restuple: mult} + + + ## + # Helpers + # + def _mk_restuple(self, action, sys, name=None): + return (action, sys, name) + + def _get_name(self, str): + name = 'unknown' + mo = self.name_re.search(str) + if mo: name = mo.group(1) + return name + + def _get_installed_name(self, str): + name = 'unknown' + mo = self.installed_name_re.search(str) + if mo: name = mo.group(1) + return name + + def _get_updated_name(self, str): + name = 'unknown' + mo = self.updated_name_re.search(str) + if mo: name = mo.group(1) + return name + + def _get_erased_name(self, str): + name = 'unknown' + mo = self.erased_name_re.search(str) + if mo: name = mo.group(1) + return name + + def finalize(self, rs): + logger = self.logger + ## + # Prepare report + # + report = '' + rep = {} + # (action, sys, name) + for action in [self.updated, self.installed, self.erased]: + rep[action] = '' + flipper = '' + for system in rs.get_distinct((action,)): + self.logger.put(3, 'system: %s' % system) + if flipper: flipper = '' + else: flipper = self.flip + service_rep = [] + + for name in rs.get_distinct((action, system,)): + service_rep.append(name) + + user_list = ', '.join(service_rep) + rep[action] += self.line_rep % (flipper, system, user_list) + + if rep[self.installed]: + report += self.subreport_wrap % (self.yum_installed_title, rep[self.installed]) + + if rep[self.updated]: + report += self.subreport_wrap % (self.yum_updated_title, rep[self.updated]) + + if rep[self.erased]: + report += self.subreport_wrap % (self.yum_erased_title, rep[self.erased]) + + report = self.report_wrap % report + return report + + +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(users_mod, sys.argv)

1 0

[epylog: 287/297] Added support for ssmtp to mail_mod and changed module priorities in config files.
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 9c29b9222d81fb8b5ec84853bd8b0888bca23254 Author: Micha vor dem Berge <m(a)mcvdb.de> Date: Wed Jan 27 13:42:22 2010 +0000 Added support for ssmtp to mail_mod and changed module priorities in config files. Signed-off-by: Konstantin Ryabitsev <mricon(a)kernel.org> etc/modules.d/mail.conf.in | 5 +++-- etc/modules.d/notices.conf.in | 2 +- etc/modules.d/spamd.conf.in | 2 +- modules/mail_mod.py | 37 ++++++++++++++++++++++++++++++++----- 4 files changed, 37 insertions(+), 9 deletions(-) --- diff --git a/etc/modules.d/mail.conf.in b/etc/modules.d/mail.conf.in index 04e107e..fc98745 100644 --- a/etc/modules.d/mail.conf.in +++ b/etc/modules.d/mail.conf.in @@ -5,15 +5,16 @@ files = /var/log/maillog[.#] enabled = yes internal = yes outhtml = yes -priority = 5 +priority = 3 [conf] ## -# Enable sendmail, postfix, or both +# Enable sendmail, postfix, qmail, ssmtp or all of them # enable_sendmail = 1 enable_postfix = 1 enable_qmail = 0 +enable_ssmtp = 0 ## # Report at most this many "top things" # diff --git a/etc/modules.d/notices.conf.in b/etc/modules.d/notices.conf.in index 3043156..93fccd3 100644 --- a/etc/modules.d/notices.conf.in +++ b/etc/modules.d/notices.conf.in @@ -5,7 +5,7 @@ files = /var/log/messages[.#], /var/log/secure[.#], /var/log/maillog[.#] enabled = yes internal = yes outhtml = yes -priority = 7 +priority = 9 [conf] ## diff --git a/etc/modules.d/spamd.conf.in b/etc/modules.d/spamd.conf.in index 7ebd7f4..107d87a 100644 --- a/etc/modules.d/spamd.conf.in +++ b/etc/modules.d/spamd.conf.in @@ -5,7 +5,7 @@ files = /var/log/maillog[.#] enabled = no internal = yes outhtml = yes -priority = 7 +priority = 4 [conf] ## diff --git a/modules/mail_mod.py b/modules/mail_mod.py index 1dfd772..9af9552 100644 --- a/modules/mail_mod.py +++ b/modules/mail_mod.py @@ -1,6 +1,8 @@ #!/usr/bin/python -tt """ -Description will eventually go here. +This is an epylog module that looks for mail relevant outputs. +Output is a general mail report (overview) and the top x systems +and recipients. """ ## # Copyright (C) 2003 by Duke University @@ -44,7 +46,7 @@ class mail_mod(InternalModule): rc = re.compile postfix_map = { rc('postfix/smtpd\[\d+\]:\s\S*:'): self.postfix_smtpd, - rc('postfix/n*qmgr\[\d+\]:\s\S*:'): self.postfix_qmgr, + rc('postfix/.*qmgr\[\d+\]:\s\S*:'): self.postfix_qmgr, rc('postfix/local\[\d+\]:\s\S*:'): self.postfix_local, rc('postfix/smtp\[\d+\]:\s\S*:\sto='): self.postfix_smtp } @@ -59,21 +61,27 @@ class mail_mod(InternalModule): rc('qmail:\s\d+.\d+\sdelivery'): self.qmail_delivery, rc('qmail:\s\d+.\d+\sbounce\smsg\s\d+'): self.qmail_bounce } + + ssmtp_map = { + rc('sSMTP\[\d+\]:\sSent\smail'): self.ssmtp_sent + } do_postfix = int(opts.get('enable_postfix', '0')) do_sendmail = int(opts.get('enable_sendmail', '1')) do_qmail = int(opts.get('enable_qmail', '0')) + do_ssmtp = int(opts.get('enable_ssmtp', '1')) self.regex_map = {} if do_postfix: self.regex_map.update(postfix_map) if do_sendmail: self.regex_map.update(sendmail_map) if do_qmail: self.regex_map.update(qmail_map) + if do_ssmtp: self.regex_map.update(ssmtp_map) self.toplim = int(opts.get('top_report_limit', '5')) self.postfix_ident_re = rc('\[\d+\]:\s*([A-Z0-9]*):') self.postfix_smtpd_re = rc('client=\S*\[(\S*)\]') - self.postfix_qmgr_re = rc('from=(\S*),.*size=(\d*)') + self.postfix_qmgr_re = rc('from=(\S*),.*size=(\d*),.*nrcpt=(\d*)') self.postfix_local_re = rc('to=(\S*),.*status=(\S*)\s$(.*)$') self.postfix_smtp_re = rc('to=(\S*),.*status=(\S*)') @@ -90,6 +98,8 @@ class mail_mod(InternalModule): self.qmail_startdev_re = rc('to\s\S+\s(\S+)') self.qmail_delivery_re = rc('delivery\s\d+:\s(\S+):') + self.ssmtp_sent_re = rc('sSMTP\[\d+\]:\sSent\smail\sfor\s(\S+)\s$(\d+).*$\suid=(\d+)\susername=(\S+)\soutbytes=(\d+)') + self.procmail_re = rc('/procmail') self.bounce = 0 @@ -104,6 +114,7 @@ class mail_mod(InternalModule): self.report_line = '<tr><td valign="top" align="right">%s</td><td valign="top" width="90%%">%s</td></tr>\n' + ## # Line-matching routines # @@ -123,8 +134,8 @@ class mail_mod(InternalModule): sys, msg, mult = self.get_smm(linemap) id = self._get_postfix_id(msg) self.logger.put(5, 'id=%s' % id) - try: sender, size = self.postfix_qmgr_re.search(msg).groups() - except: sender, size = (None, 0) + try: sender, size, recipients = self.postfix_qmgr_re.search(msg).groups() + except: sender, size, recipients = (None, 0, 0) size = int(size) self.logger.put(5, 'sender=%s, size=%d' % (sender, size)) restuple = self._mk_restuple(sys, id, sender=sender, size=size) @@ -235,6 +246,22 @@ class mail_mod(InternalModule): restuple = self._mk_restuple(sys, id, status=self.bounce) return {restuple: mult} + def ssmtp_sent(self, linemap): + sys, msg, mult = self.get_smm(linemap) + try: to, status, uid, user, size = self.ssmtp_sent_re.search(msg).groups() + except: + self.logger.put(3, 'Odd ssmtp_sent line: %s' % msg) + return None + size = int (size) + status = int (status) + self.logger.put(5, 'to=%s, status=%i, uid=%s, user=%s, size=%i' % (to, status, uid, user, size)) + if (status >= 100) and (status <= 199): status = self.warning + elif (status >= 200) and (status <= 299): status = self.success + elif (status >= 300) and (status <= 499): status = self.bounce + elif (status >= 500) and (status <= 599): status = self.warning + restuple = self._mk_restuple(sys, id, to=to, status=status, size=size) + return {restuple: mult} + ## # HElpers #

1 0

[epylog: 286/297] Added missing config file for the new ntpd module
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit 81a29eb21be6fe80066cbe3379c64e5d0d251787 Author: Micha vor dem Berge <m(a)mcvdb.de> Date: Wed Jan 27 12:22:41 2010 +0000 Added missing config file for the new ntpd module Signed-off-by: Konstantin Ryabitsev <mricon(a)kernel.org> etc/modules.d/ntp.conf.in | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) --- diff --git a/etc/modules.d/ntp.conf.in b/etc/modules.d/ntp.conf.in new file mode 100644 index 0000000..4a90bac --- /dev/null +++ b/etc/modules.d/ntp.conf.in @@ -0,0 +1,8 @@ +[module] +desc = NTP +exec = %%MODULES_DIR%%/sntp_mod.py +files = /var/log/syslog[.#] +enabled = yes +internal = yes +outhtml = yes +priority = 8

1 0

[epylog: 285/297] Added a new module (and a testcase) for ntpd-messages
by Konstantin Ryabitsev 23 Jan '12

23 Jan '12

commit f0ef3afd32add54e4c9a2f9ba42a7f8a3421ed1c Author: Micha vor dem Berge <m(a)mcvdb.de> Date: Wed Jan 27 12:19:37 2010 +0000 Added a new module (and a testcase) for ntpd-messages Signed-off-by: Konstantin Ryabitsev <mricon(a)kernel.org> doc/testcase/ntp.testcase | 16 ++++++ modules/ntp_mod.py | 129 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 145 insertions(+), 0 deletions(-) --- diff --git a/doc/testcase/ntp.testcase b/doc/testcase/ntp.testcase new file mode 100644 index 0000000..7507e89 --- /dev/null +++ b/doc/testcase/ntp.testcase @@ -0,0 +1,16 @@ +Jul 27 00:55:18 trixi ntpd[2852]: synchronized to 213.239.202.209, stratum 2 +Jul 27 02:20:42 trixi ntpd[2852]: synchronized to 78.47.89.89, stratum 2 +Jul 27 03:11:30 trixi ntpd[2852]: synchronized to 213.239.202.209, stratum 2 +Jul 27 00:55:18 foo ntpd[2852]: synchronized to 213.239.202.209, stratum 2 +Jul 27 02:20:42 foo ntpd[2852]: synchronized to 78.47.89.89, stratum 2 +Jul 27 03:11:30 foo ntpd[2852]: synchronized to 213.239.202.209, stratum 2 +Jul 27 02:20:42 trixi ntpd[2852]: synchronized to 78.47.89.89, stratum 1 +Jul 27 03:11:30 trixi ntpd[2852]: synchronized to 213.239.202.209, stratum 1 +Jul 27 00:55:18 foo ntpd[2852]: synchronized to 213.239.202.209, stratum 1 +Jul 27 02:20:42 foo ntpd[2852]: synchronized to 78.47.89.89, stratum 1 +Jan 24 02:25:25 trixi ntpd[3326]: kernel time sync status change 0001 +Jan 24 02:59:35 trixi ntpd[3326]: kernel time sync status change 4001 +Jan 24 03:33:42 trixi ntpd[3326]: kernel time sync status change 0001 +Jan 24 04:07:51 trixi ntpd[3326]: kernel time sync status change 4001 +Jan 24 03:33:42 bar ntpd[3326]: kernel time sync status change 0001 +Jan 24 04:07:51 bar ntpd[3326]: kernel time sync status change 4001 diff --git a/modules/ntp_mod.py b/modules/ntp_mod.py new file mode 100644 index 0000000..fdf94b0 --- /dev/null +++ b/modules/ntp_mod.py @@ -0,0 +1,129 @@ +#!/usr/bin/python -tt +""" +This is an epylog module to monitor output from ntpd. +It considers outputs which look like "status change to ..." +and "synchronized to stratum ..." +""" +## +# Copyright (C) 2009-2010 Micha vor dem Berge +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA +# 02111-1307, USA. +# +# $Id: ntp_mod.py 383 2010-01-16 12:45:24Z mvdb $ +# +# @Author Micha vor dem Berge <m(a)mcvdb.de> +# @version $Date: 2010-01-16 13:45:24 +0100 (Sa, 16. Jan 2010) $ +# + +import sys +import re + +sys.path.insert(0, '../py/') +from epylog import InternalModule + +class ntp_mod(InternalModule): + def __init__(self, opts, logger): + InternalModule.__init__(self) + self.logger = logger + + rc = re.compile + + self.msg = 1 + self.error = 2 + + self.regex_map = { + rc('ntpd.*:\ssynchronized\sto.*'): self.ntp_synchronized, + rc('kernel time sync status change'): self.ntp_status_change + } + + self.ntp_synchronized_re = rc('ntpd\[\d+\]:\ssynchronized\sto\s*(\S*),\s*(.*)') + self.ntp_status_change_re = rc('ntpd\[\d+\]:\skernel\stime\ssync\sstatus\schange\s(\d+)') + + self.ntp_message_title = '<font color="blue">Message</font>' + self.report_wrap = '<table width="100%%" rules="cols" cellpadding="2">%s</table>' + self.subreport_wrap = '<tr><th align="left" colspan="3"><h3>%s</h3></th></tr>\n%s\n' + self.line_rep = '<tr%s><td valign="top" width="15%%">%s</td><td valign="top" width="15%%">%s</td><td width="70%%">%s</td></tr>\n' + self.flip = ' bgcolor="#dddddd"' + + + ## + # Line-matching routines + # + def ntp_synchronized (self, linemap): + action = self.msg + system, message, mult = self.get_smm(linemap) + mo = self.ntp_synchronized_re.search(message) + if not mo: + self.logger.put(3, 'Odd ntp synchronized string: %s' % message) + return None + rhost, stratum = mo.groups() + stratum = "synchronized to " + stratum + restuple = (action, system, stratum, rhost) + return {restuple: linemap['multiplier']} + + + def ntp_status_change (self, linemap): + action = self.msg + system, message, mult = self.get_smm(linemap) + ntp_status = self.ntp_status_change_re.search(message).group(1) + if not ntp_status: + self.logger.put(3, 'Odd ntp status change string: %s' % message) + return None + ntp_status = ntp_status + restuple = (action, system, "status change to", ntp_status) + return {restuple: linemap['multiplier']} + + + def finalize(self, resultset): + logger = self.logger + + report = '' + rep = {} + for action in [self.msg]: + rep[action] = '' + flipper = '' + for key in resultset.get_distinct((action,)): + if flipper: flipper = '' + else: flipper = self.flip + ntp_msg_rep = [] + for ntp_msg in resultset.get_distinct((action, key)): + mymap = resultset.get_submap((action, key, ntp_msg)) + key2s = [] + for key2 in mymap.keys(): + loghost = key2[0] + key2s.append('%s (%d)' % (loghost, mymap[key2])) + loghosts = ', '.join(key2s) + ntp_msg_rep.append([ntp_msg, loghosts]) + #if len(key2s) > self.systems_collapse: + # loghosts = self.collapsed_rep % (key2s[0],len(key2s)-1) + #else: + blank = 0 + for msgrep in ntp_msg_rep: + if blank: key = ' ' + else: blank = 1 + rep[action] += self.line_rep % (flipper, + key, msgrep[0], msgrep[1]) + if rep[self.msg]: + report += self.subreport_wrap % (self.ntp_message_title, + rep[self.msg]) + + report = self.report_wrap % report + return report + + +if __name__ == '__main__': + from epylog.helpers import ModuleTest + ModuleTest(ntp_mod, sys.argv)

1 0

← Newer
1
2
3
4
5
6
7
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

epylog