1

     2

--

     3

-- Helper functions

     4

--

     5

     6

-- match all lines and output them as-is

     7

local function logwatch_filter_all (name)

     8

    return { name=name }

     9

end

    10

    11

-- match using a regex pattern, but output the full line

    12

local function logwatch_filter_raw (name, pat)

    13

    return { name=name, pat=pat }

    14

end

    15

    16

-- match using a regexp pattern, and output a formatted line

    17

local function logwatch_filter (name, pat, fmt)

    18

    return { name=name, pat=pat, fmt=fmt }

    19

end

    20

    21

-- match using a regexp pattern, and do *not* output

    22

local function logwatch_filter_blackhole (name, pat)

    23

    return { name=name, pat=pat, channel_is_null=true }

    24

end

    25

    26

logwatch_timestamp_pat = "\\w{3} [0-9 ]\\d \\d{2}:\\d{2}:\\d{2}"

    27

    28

-- match auth.log sudo entries

    29

local function logwatch_filter_sudo (name)

    30

    return logwatch_filter(name,

    31

        "^" .. logwatch_timestamp_pat .. " (?P<hostname>\\S+)\\s+sudo:\\s*(?P<username>\\S+) : TTY=(?P<tty>\\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\\S+) ; COMMAND=(?P<command>.*)$",

    32

        "{username}:{tty} - {target_user}@{hostname}:{pwd} - {command:r}"

    33

    )

    34

end

    35

    36

-- filter out the prefixed timestamp from lines

    37

local function logwatch_filter_strip_timestamp (name)

    38

    return logwatch_filter(name,

    39

        "^" .. logwatch_timestamp_pat .. " (?P<line>.+)$",

    40

        "{line}"

    41

    )

    42

end

    43

    44

-- filter out auth.log cron messages

    45

local function logwatch_filter_no_cron (name)

    46

    return logwatch_filter_blackhole(name,

    47

        "^" .. logwatch_timestamp_pat .. " \\S+\\s+(CRON|su)\\[\\d+\\]: pam_unix\\(\\w+:\\w+\\): session (opened|closed) for user \\w+( by \\(uid=\\d+\\))?$"

    48

    )

    49

end

    50

    51

-- filter out auth.log 'su for nobody by root' messages

    52

local function logwatch_filter_no_su_nobody (name)

    53

    return logwatch_filter_blackhole(name,

    54

        "^" .. logwatch_timestamp_pat .. " \\S+\\s+su\\[\\d+\\]: (Successful su for nobody by root|\\+ \\?\\?\\? root:nobody)$"

    55

    )

    56

end

    57

    58

--

    59

-- Procedural config

    60

--

    61

local function apply_config (conf)

    62

    -- apply general

    63

    log_level(conf.log_level)

    64

    65

    -- apply conf.name

    66

    client:set_defaults(conf.name.nickname, conf.name.username, conf.name.realname)

    67

    68

    -- apply conf.networks

    69

    for network, settings in pairs(conf.networks) do

    70

        -- establish the irc_net

    71

        net = client:connect(network, settings.hostname)

    72

    73

        -- join each channel

    74

        for i, channel in ipairs(settings.channels) do

    75

            net:join(channel)

    76

        end

    77

    end

    78

    79

    -- apply conf.modules_path

    80

    if conf.modules_path then

    81

        modules:path(conf.modules_path)

    82

    end

    83

    84

    -- apply conf.modules

    85

    for name, settings in pairs(conf.modules) do

    86

        -- load the module

    87

        module = modules:load(name, settings.path)

    88

    89

        -- apply confs

    90

        for key, value in pairs(settings.conf) do

    91

            module:conf(key, value)

    92

        end

    93

    end

    94

    95

    -- conf.mod_logwatch

    96

    if conf.mod_logwatch then

    97

        module = modules:load("logwatch")

    98

    99

        for fifo_path, settings in pairs(conf.mod_logwatch) do

   100

            module:conf("source_fifo", fifo_path)

   101

            source_name = fifo_path

   102

   103

            for i, filter in ipairs(settings.filters) do

   104

                if filter.channel_is_null then

   105

                    channel = nil

   106

                else

   107

                    channel = settings.channel

   108

                end

   109

   110

                module:conf("filter", filter.name, source_name, filter.pat, filter.fmt, channel)

   111

            end

   112

        end

   113

    end

   114

end

   115

   116

--

   117

-- Declarative configuration settings

   118

--

   119

apply_config{

   120

    log_level   = "DEBUG",

   121

   122

    name = {

   123

        nickname    = "SpBotDev",

   124

        username    = "spbot-dev",

   125

        realname    = "SpBot (development version)"

   126

    },

   127

   128

    networks = {

   129

        PVLNet      = {

   130

            hostname    = "irc.fixme.fi",

   131

   132

            channels    = {

   133

                "#test"

   134

            }

   135

        },

   136

    },

   137

   138

    modules_path    = "src/modules",

   139

   140

    modules = {

   141

        irc_log     = {

   142

            conf        = {

   143

                db_info     = "dbname=spbot",

   144

                channel     = "PVLNet/#test",

   145

            }

   146

        }

   147

    },

   148

   149

    mod_logwatch = {

   150

        ["test.fifo"] = {

   151

            channel     = "PVLNet/#test",

   152

   153

            filters     = {

   154

                logwatch_filter_raw             ("test.foo", "foo"  ),

   155

                logwatch_filter_sudo            ("test.sudo"        ),

   156

                logwatch_filter_no_cron         ("test.no_cron"     ),

   157

                logwatch_filter_no_su_nobody    ("test.no_cron_su"  ),

   158

                logwatch_filter_strip_timestamp ("test.all"         )

   159

            }

   160

        },

   161

    },

   162

}

   163