1

import re

     2

     3

class BaseFilter (object) :

     4

    """

     5

        A filter object matches incoming lines, to determine how they are handled, classify them, and optionally reformat them

     6

    """

     7

     8

    # the LogWatchModule event to send

     9

    label = None

    10

    11

    def __init__ (self, label) :

    12

        self.label = label

    13

    14

    def test (self, line) :

    15

        """

    16

            Match against the given line. See match() for return codes

    17

        """

    18

    19

        raise NotImplementedError()

    20

    21

    def match (self, msg) :

    22

        """

    23

            Match against the given SyslogMessage, and return one of:

    24

                None        - filter did not match, continue

    25

                False       - filter matched, line should be dropped

    26

                    (label, <str>)

    27

                            - filter matched, pass formatted output with given label

    28

        """

    29

    30

        # default to a full-line match

    31

        return self.test(str(msg))

    32

    33

class FullFilter (BaseFilter) :

    34

    """

    35

        A trivial filter that matches every possible line as-is

    36

    """

    37

    38

    def test (self, line) :

    39

        # pass through

    40

        return self.label, line

    41

    42

class NullFilter (BaseFilter) :

    43

    """

    44

        A filter that drops every line matching a given regexp

    45

    """

    46

    47

    def __init__ (self, pattern, flags=0) :

    48

        # don't need an label

    49

    50

        self.regexp = re.compile(pattern, flags)

    51

    52

    def test (self, line) :

    53

        match = self.regexp.search(line)

    54

    55

        if match :

    56

            # drop

    57

            return False

    58

    59

class SimpleFilter (BaseFilter) :

    60

    """

    61

        A simple filter that passes through any lines that match, optionally reformatting them with the given string

    62

        pattern, using the regexp match groups as parameters.

    63

    """

    64

    65

    def __init__ (self, label, pattern, format=None) :

    66

        super(SimpleFilter, self).__init__(label)

    67

    68

        # store

    69

        self.regexp = re.compile(pattern)

    70

        self.format = format

    71

    72

    def test (self, line) :

    73

        # match

    74

        match = self.regexp.search(line)

    75

    76

        if not match :

    77

            # continue

    78

            return None

    79

    80

        # reformat?

    81

        if self.format :

    82

            # format with regexp match groups

    83

            return self.label, self.format % match.groupdict()

    84

    85

        else :

    86

            # match as-is

    87

            return self.label, line

    88

    89

class SyslogFilter (BaseFilter) :

    90

    """

    91

        A more advanced filter that can match against fields in the syslog message.

    92

    """

    93

    94

    def __init__ (self, label, pattern=None, program=None, drop=False, format=None, re_flags=0) :

    95

        """

    96

            Filter using the given criteria:

    97

    98

            label           - label match output with given label

    99

   100

            pattern         - match message content against given regexp

   101

            program         - (optional) case-insensitive match against message tag's program component

   102

                                May also be False to indicate no tag

   103

   104

            drop            - drop this message if this matches

   105

            format          - (optional) format output with given format string

   106

   107

            re_flags        - (optional) flags for regular expression

   108

        """

   109

   110

        # XXX: super(SyslogFilter, self).__init__(label)

   111

        self.label = label

   112

   113

        # store

   114

        if pattern :

   115

            self.regexp = re.compile(pattern, re_flags)

   116

        else :

   117

            self.regexp = None

   118

   119

        self.program = program

   120

   121

        self.drop = drop

   122

        self.format = format

   123

   124

    def match (self, msg) :

   125

        """

   126

            Evaluate match on given message

   127

        """

   128

   129

        # use the SyslogMessage's match method

   130

        match = msg.match(self.regexp, self.program)

   131

   132

        # handle result

   133

        if match is False :

   134

            # nack

   135

            return None

   136

   137

        elif self.drop :

   138

            # halt processing

   139

            return False

   140

   141

        elif self.format :

   142

            # the messages properties

   143

            params = msg.properties()

   144

   145

            # the regexp'd matched params

   146

            params.update(match)

   147

   148

            # formatted output

   149

            return self.label, self.format % params

   150

   151

        else :

   152

            # boring output

   153

            return self.label, str(msg)

   154

   155

   156

# matches a timestamp prefix

   157

_timestamp = "\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}"

   158

   159

   160

# match all lines, but doesn't include the timestamp

   161

all = SyslogFilter('all',

   162

    format  = "%(hostname)s %(message)s"

   163

)

   164

   165

# match sudo invocations, reformatting them nicely

   166

sudo = SyslogFilter('sudo',

   167

    program = "sudo",

   168

    pattern = r"^\s*(?P<username>\S+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>.+?) ; USER=(?P<target_user>\S+) ; COMMAND=(?P<command>.*)",

   169

    format  = "%(username)s:%(tty)s - %(target_user)s@%(hostname)s:%(pwd)s - %(command)r",

   170

)

   171

   172

# match accepted ssh logins

   173

ssh = SyslogFilter('ssh',

   174

    program = "sshd",

   175

    pattern = r"^\s*Accepted password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)",

   176

    format  = "SSH login for %(username)s@%(hostname)s from %(ip)s:%(port)s",

   177

)

   178

   179

# drops all output from cron

   180

# XXX: what about the same from su?

   182

    program = "cron",

   183

    drop    = True,

   184

)

   185

   186

# drops `su nobody` output (from cron)

   188

    program     = "su",

   189

    pattern     = r"^(Successful su for nobody by root|\+ \?\?\? root:nobody)$",

   190

    re_flags    = re.IGNORECASE,

   191

    drop        = True

   192

)

   193