1

from twisted.internet import protocol, reactor

     2

from twisted.python import log

     3

import sys, re

     4

     5

import api

     6

     7

class TailProcessProtocol (protocol.ProcessProtocol) :

     8

    def __init__ (self, module, name, filters) :

     9

        self.module = module

    10

        self.name = name

    11

        self.filters = filters

    12

    13

        self.buf = ""

    14

    15

    def errReceived (self, data) :

    16

        self.module.error("tail for %s: %s" % (self.name, data))

    17

    18

    def outReceived (self, data) :

    19

        data = self.buf + data

    20

    21

        while "\n" in data :

    22

            line, data = data.split("\n", 1)

    23

    24

            log.msg("Matching line `%s'..." % line)

    25

    26

            for filter in self.filters :

    27

                out = filter.test(line)

    28

    29

                if out :

    30

                    log.msg("\t%s: %s" % (filter.event_type, out))

    31

                    self.module.sendEvent(filter.event_type, out)

    32

    33

        self.buf = data

    34

    35

    def processEnded (self, reason) :

    36

        msg = "tail process for %s quit: %s" % (self.name, reason.getErrorMessage())

    37

    38

        log.err(msg)

    39

        self.module.error(msg)

    40

    41

class Filter (object) :

    42

    def __init__ (self, regexp, event_type) :

    43

        self.regexp = re.compile(regexp)

    44

        self.event_type = event_type

    45

    46

    def test (self, line) :

    47

        match = self.regexp.search(line)

    48

    49

        if match :

    50

            return self._filter(match)

    51

    52

    def _filter (self, match) :

    53

        return match.string

    54

    55

class AutoFilter (Filter) :

    56

    # your event type here, as a string

    57

    EVENT = None

    58

    59

    # your regexp here, with named matchgroups

    60

    REGEXP = None

    61

    62

    # your output format, with named interpolation params

    63

    OUTPUT = None

    64

    65

    def __init__ (self) :

    66

        super(AutoFilter, self).__init__(self.REGEXP, self.EVENT)

    67

    68

    def _filter (self, match) :

    69

        return self.OUTPUT % match.groupdict()

    70

    71

class SudoFilter (AutoFilter) :

    72

    EVENT   = "sudo"

    73

    REGEXP  = "sudo:\s*(?P<username>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\S+) ; COMMAND=(?P<command>.*)"

    74

    OUTPUT  = "%(username)s:%(tty)s - %(pwd)s - `%(command)s` as %(target_user)s"

    75

    76

class SSHFilter (AutoFilter) :

    77

    EVENT   = "ssh"

    78

    REGEXP  = "(?P<success>Accepted|Failed) password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)"

    79

    OUTPUT  = "%(success)s login for %(username)s from %(ip)s:%(port)s proto %(proto)s"

    80

    81

class LogWatchModule (api.Module) :

    82

    name = "logs"

    83

    version = 0x0001

    84

    85

    event_types = [

    86

        "error",

    87

        "sudo",

    88

        "ssh",

    89

    ]

    90

    91

    log_files = (

    92

        ("auth.log", "/var/log/auth.log", (

    93

            SudoFilter(),

    94

            SSHFilter(),

    95

        )),

    96

    )

    97

    98

    log_objs = None

    99

   100

    def handleConnect (self) :

   101

        log.msg("Spawning tail processes...")

   102

   103

        self.log_objs = dict()

   104

   105

        for name, file, filters in self.log_files :

   106

            log.msg("\t%s - %s..." % (name, file))

   107

   108

            p = self.log_objs[name] = TailProcessProtocol(self, name, filters)

   109

   110

            reactor.spawnProcess(p, "/usr/bin/tail", ["tail", "-n0", "--follow=name", file])

   111

   112

    def error (self, msg) :

   113

        self.sendEvent("error", msg)

   114

   115

if __name__ == '__main__' :

   116

    LogWatchModule().run()

   117