1

import re

     2

     3

class BaseFilter (object) :

     4

    """

     5

        A filter object matches incoming lines, to determine how they are handled, classify them, and optionally reformat them

     6

    """

     7

     8

    # the LogWatchModule event to send

     9

    event_type = None

    10

    11

    def __init__ (self, event_type) :

    12

        self.event_type = event_type

    13

    14

    def test (self, line) :

    15

        """

    16

            Match against the given line, and return one of:

    17

    18

                None        - filter did not match, continue

    19

                False       - filter matched, line should be dropped

    20

                    (type, <str>)

    21

                            - filter matched, pass formatted output

    22

        """

    23

    24

        raise NotImplementedError()

    25

    26

class FullFilter (BaseFilter) :

    27

    """

    28

        A trivial filter that matches every possible line as-is

    29

    """

    30

    31

    def test (self, line) :

    32

        # pass through

    33

        return self.event_type, line

    34

    35

class NullFilter (BaseFilter) :

    36

    """

    37

        A filter that drops every line matching a given regexp

    38

    """

    39

    40

    def __init__ (self, pattern, flags=None) :

    41

        # don't need an event_type

    42

    43

        self.regexp = re.compile(pattern, flags)

    44

    45

    def test (self, line) :

    46

        match = self.regexp.search(line)

    47

    48

        if match :

    49

            # drop

    50

            return False

    51

    52

class SimpleFilter (BaseFilter) :

    53

    """

    54

        A simple filter that passes through any lines that match, optionally reformatting them with the given string

    55

        pattern, using the regexp match groups as parameters.

    56

    """

    57

    58

    def __init__ (self, event_type, pattern, format=None) :

    59

        super(SimpleFilter, self).__init__(event_type)

    60

    61

        # store

    62

        self.regexp = re.compile(pattern)

    63

        self.format = format

    64

    65

    def test (self, line) :

    66

        # match

    67

        match = self.regexp.search(line)

    68

    69

        if not match :

    70

            # continue

    71

            return None

    72

    73

        # reformat?

    74

        if self.format :

    75

            # format with regexp match groups

    76

            return self.event_type, self.format % match.groupdict()

    77

    78

        else :

    79

            # match as-is

    80

            return self.event_type, line

    81

    82

# matches a timestamp prefix

    83

_timestamp = "\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}"

    84

    85

    86

# matches all lines

    87

all = FullFilter("all")

    88

    89

# match all lines, but drop the prefixed timestamp

    90

all_wo_timestamps = SimpleFilter(

    91

    "all",

    92

    "^" + _timestamp + " (?P<line>.+)$",

    93

    "%(line)s"

    94

)

    95

    96

# match sudo invocations, reformatting them nicely

    97

sudo = SimpleFilter(

    98

    "sudo",

    99

    "(?P<hostname>\S+)\s+sudo:\s*(?P<username>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\S+) ; COMMAND=(?P<command>.*)",

   100

    "%(username)s:%(tty)s - %(target_user)s@%(hostname)s:%(pwd)s - %(command)r"

   101

)

   102

   103

# match accepted ssh logins

   104

ssh = SimpleFilter(

   105

    "ssh",

   108

)

   109

   110

# drops pam output from cron

   111

cron_killer = NullFilter(

   112

        "^" + _timestamp + " \S+\s+(CRON|su)\[\d+\]: pam_unix\(cron:\w+\): session (opened|closed) for user \w+( by \(uid=\d+\))?$",

   113

        re.IGNORECASE

   114

)

   115

   116

# drops `su nobody` output (from cron)

   117

su_nobody_killer = NullFilter(

   118

    "^" + _timestamp + " \S+\s+su\[\d+\]: (Successful su for nobody by root|\+ \?\?\? root:nobody)$",

   119

    re.IGNORECASE

   120

)

   121