1

import re

     2

     3

class Filter (object) :

     4

    def __init__ (self, regexp, event_type) :

     5

        self.regexp = re.compile(regexp)

     6

        self.event_type = event_type

     7

     8

    def test (self, line) :

     9

        match = self.regexp.search(line)

    10

    11

        if match :

    12

            return self._filter(match)

    13

    14

    def _filter (self, match) :

    15

        return match.string

    16

    17

class AutoFilter (Filter) :

    18

    # your event type here, as a string

    19

    EVENT = None

    20

    21

    # your regexp here, with named matchgroups

    22

    REGEXP = None

    23

    24

    # your output format, with named interpolation params

    25

    OUTPUT = None

    26

    27

    def __init__ (self) :

    28

        super(AutoFilter, self).__init__(self.REGEXP, self.EVENT)

    29

    30

    def _filter (self, match) :

    31

        return self.OUTPUT % match.groupdict()

    32

    33

class SudoFilter (AutoFilter) :

    34

    EVENT   = "sudo"

    35

    REGEXP  = "sudo:\s*(?P<username>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\S+) ; COMMAND=(?P<command>.*)"

    36

    OUTPUT  = "%(username)s:%(tty)s - %(pwd)s - `%(command)s` as %(target_user)s"

    37

    38

class SSHFilter (AutoFilter) :

    39

    EVENT   = "ssh"

    40

    REGEXP  = "(?P<success>Accepted|Failed) password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)"

    41

    OUTPUT  = "%(success)s login for %(username)s from %(ip)s:%(port)s proto %(proto)s"

    42

    43