source: trunk/src/sh_log_check.c@ 277

Last change on this file since 277 was 277, checked in by katerina, 15 years ago

Fix for bug in kernel check (ticket #198).

File size: 34.8 KB
Line 
1
2#include "config_xor.h"
3
4#include <stdio.h>
5#include <string.h>
6#include <stdlib.h>
7#include <sys/types.h>
8#include <sys/stat.h>
9#include <fcntl.h>
10
11#ifdef HAVE_DIRENT_H
12#include <dirent.h>
13#define NAMLEN(dirent) sl_strlen((dirent)->d_name)
14#else
15#define dirent direct
16#define NAMLEN(dirent) (dirent)->d_namlen
17#ifdef HAVE_SYS_NDIR_H
18#include <sys/ndir.h>
19#endif
20#ifdef HAVE_SYS_DIR_H
21#include <sys/dir.h>
22#endif
23#ifdef HAVE_NDIR_H
24#include <ndir.h>
25#endif
26#endif
27
28#if !defined(O_NONBLOCK)
29#if defined(O_NDELAY)
30#define O_NONBLOCK O_NDELAY
31#else
32#define O_NONBLOCK 0
33#endif
34#endif
35
36#ifdef USE_LOGFILE_MONITOR
37
38#undef FIL__
39#define FIL__ _("sh_log_check.c")
40
41/* Debian/Ubuntu: libpcre3-dev */
42#ifdef HAVE_PCRE_PCRE_H
43#include <pcre/pcre.h>
44#else
45#include <pcre.h>
46#endif
47
48#include "samhain.h"
49#include "sh_pthread.h"
50#include "sh_utils.h"
51#include "sh_unix.h"
52#include "sh_string.h"
53#include "sh_log_check.h"
54#include "sh_log_evalrule.h"
55#include "sh_log_correlate.h"
56#include "sh_log_mark.h"
57#include "sh_log_repeat.h"
58#include "sh_extern.h"
59
60/* List of supported logfile types, format is
61 * {
62 * "TYPE_CODE",
63 * Reader_Callback_Function,
64 * Parser_Callback_function,
65 * Evaluate_Callback_Function
66 * }
67 * If Reader_Callback_Function is NULL, the default (line-oriented
68 * text file) reader is used.
69 */
70struct sh_logfile_type sh_logtypes_def[] = {
71 { "SYSLOG", NULL, sh_parse_syslog, NULL },
72 { "SAMBA", sh_read_samba, sh_parse_samba, NULL },
73 { "APACHE", NULL, sh_parse_apache, sh_eval_fileinfo_apache },
74#if defined(HAVE_SYS_ACCT_H)
75 { "PACCT", sh_read_pacct, sh_parse_pacct, NULL },
76#endif
77 { "SHELL", sh_read_shell, sh_parse_shell, NULL },
78};
79
80/* -------------------------- Internal Stuff -------------------------- */
81
82struct logfile_record {
83 dev_t device_id;
84 ino_t inode;
85 fpos_t offset;
86};
87
88static int do_checkpoint_cleanup = S_FALSE;
89
90static char * save_dir = NULL;
91
92static const char * get_save_dir(void)
93{
94 int retval;
95
96 if (!save_dir)
97 {
98 save_dir = sh_util_strdup(DEFAULT_DATAROOT);
99
100 SH_MUTEX_LOCK(mutex_thread_nolog);
101 retval = tf_trust_check (save_dir, SL_YESPRIV);
102 SH_MUTEX_UNLOCK(mutex_thread_nolog);
103
104 if (retval != 0)
105 {
106 return(NULL);
107 }
108 }
109 return save_dir;
110}
111
112static void clean_dir()
113{
114 DIR * dir;
115 struct dirent * entry;
116
117 const char * dirpath;
118
119 if (S_FALSE == do_checkpoint_cleanup)
120 return;
121
122 dirpath = get_save_dir();
123
124 if (dirpath)
125 {
126 dir = opendir(dirpath);
127 if (dir)
128 {
129 unsigned long a, b;
130 int retval;
131 char c;
132 size_t dlen = strlen(dirpath) + 1;
133 time_t now = time(NULL);
134
135 while (NULL != (entry = readdir(dir)))
136 {
137 retval = sscanf(entry->d_name, "%lu_%lu%c", &a, &b, &c);
138
139 if (2 == retval)
140 {
141 struct stat buf;
142 char * path;
143 size_t plen = strlen(entry->d_name) + 1;
144
145 if (SL_TRUE == sl_ok_adds(plen, dlen))
146 {
147 plen += dlen;
148 path = SH_ALLOC(plen);
149 (void) sl_snprintf(path, plen, "%s/%s",
150 dirpath,entry->d_name);
151
152 if (0 == retry_lstat(FIL__, __LINE__, path, &buf) &&
153 S_ISREG(buf.st_mode))
154 {
155 if (buf.st_mtime < now &&
156 (now - buf.st_mtime) > 2592000) /* 30 days */
157 {
158 if (0 == tf_trust_check (path, SL_YESPRIV))
159 {
160 unlink(path);
161 }
162 }
163 }
164 }
165 }
166 }
167 closedir(dir);
168 }
169 }
170}
171
172static char * build_path (struct sh_logfile * record)
173{
174 size_t plen;
175 char * path = NULL;
176 const char * dir = get_save_dir();
177
178 if (dir)
179 {
180 plen = strlen(dir);
181
182 if (SL_TRUE == sl_ok_adds(plen, 130))
183 {
184 plen += 130; /* 64 + 64 + 2 */
185 path = SH_ALLOC(plen);
186 (void) sl_snprintf(path, plen, "%s/%lu_%lu", dir,
187 (unsigned long) record->device_id,
188 (unsigned long) record->inode);
189 }
190 }
191
192 return path;
193}
194
195static void save_pos (struct sh_logfile * record)
196{
197 char * path;
198 FILE * fd;
199 mode_t mask;
200 struct logfile_record save_rec;
201
202 path = build_path(record);
203
204 if (path)
205 {
206 if (0 != sh_unix_check_piddir (path))
207 {
208 SH_FREE(path);
209 return;
210 }
211
212 mask = umask(S_IWGRP | S_IWOTH);
213 fd = fopen(path, "wb");
214 (void) umask(mask);
215
216 if (fd)
217 {
218 save_rec.device_id = record->device_id;
219 save_rec.inode = record->inode;
220 memcpy(&(save_rec.offset), &(record->offset), sizeof(fpos_t));
221 if (1 != fwrite(&save_rec, sizeof(struct logfile_record), 1, fd))
222 {
223 (void) sl_fclose(FIL__, __LINE__, fd);
224 (void) remove(path);
225 }
226 else
227 {
228 (void) sl_fclose(FIL__, __LINE__, fd);
229 }
230 }
231 SH_FREE(path);
232 }
233 return;
234}
235
236static int read_pos (struct sh_logfile * record)
237{
238 int retval = 0;
239 char * path;
240 FILE * fd;
241 struct logfile_record save_rec;
242
243 path = build_path(record);
244
245 if (path)
246 {
247 fd = fopen(path, "rb");
248 if (fd)
249 {
250 if (1 == fread(&save_rec, sizeof(struct logfile_record), 1, fd))
251 {
252 if (save_rec.device_id == record->device_id &&
253 save_rec.inode == record->inode)
254 {
255 memcpy(&(record->offset),&(save_rec.offset),sizeof(fpos_t));
256 retval = 1;
257 }
258 }
259 (void) sl_fclose(FIL__, __LINE__, fd);
260 }
261 SH_FREE(path);
262 }
263 return retval;
264}
265
266/*@null@*/ static struct sh_logfile * sh_watched_logs = NULL;
267
268int sh_add_watch (const char * str)
269{
270 char * filename;
271
272 unsigned int i;
273 unsigned int defsize;
274 struct sh_logfile_type * log_type = NULL;
275 struct sh_logfile * thisfile;
276 struct stat buf;
277
278 unsigned int nfields = 3; /* logtype:path[:regex] */
279 size_t lengths[3];
280 char * new = sh_util_strdup(str);
281 char ** splits = split_array(new, &nfields, ':', lengths);
282
283 if (nfields < 2 || (lengths[0] == 0 || lengths[0] >= SH_MAX_LCODE_SIZE || lengths[1] == 0))
284 {
285 sh_string * msg = sh_string_new(0);
286 sh_string_add_from_char(msg, _("Format error: "));
287 sh_string_add_from_char(msg, str);
288
289 SH_MUTEX_LOCK(mutex_thread_nolog);
290 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
291 sh_string_str(msg),
292 _("sh_add_watch"));
293 SH_MUTEX_UNLOCK(mutex_thread_nolog);
294 sh_string_destroy(&msg);
295
296 SH_FREE(new);
297 return -2;
298 }
299
300 defsize =
301 (unsigned int) (sizeof(sh_logtypes_def)/sizeof(struct sh_logfile_type));
302
303 for (i = 0; i < defsize; ++i)
304 {
305 if (0 == strcmp(splits[0], sh_logtypes_def[i].code))
306 {
307 log_type = &(sh_logtypes_def[i]);
308 break;
309 }
310 }
311
312 if (log_type == NULL)
313 {
314 sh_string * msg = sh_string_new(0);
315 sh_string_add_from_char(msg, _("Unsupported log type: "));
316 sh_string_add_from_char(msg, splits[0]);
317
318 SH_MUTEX_LOCK(mutex_thread_nolog);
319 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
320 sh_string_str(msg),
321 _("sh_add_watch"));
322 SH_MUTEX_UNLOCK(mutex_thread_nolog);
323 sh_string_destroy(&msg);
324
325 SH_FREE(new);
326 return -3;
327 }
328
329 if (splits[1][0] != '/' && 0 != strcmp(splits[0], _("SHELL")))
330 {
331 sh_string * msg = sh_string_new(0);
332 sh_string_add_from_char(msg, _("Logfile path not absolute: "));
333 sh_string_add_from_char(msg, splits[1]);
334
335 SH_MUTEX_LOCK(mutex_thread_nolog);
336 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
337 sh_string_str(msg),
338 _("sh_add_watch"));
339 SH_MUTEX_UNLOCK(mutex_thread_nolog);
340 sh_string_destroy(&msg);
341
342 SH_FREE(new);
343 return -4;
344 }
345
346 filename = /*@i@*/sh_util_strdup(splits[1]);
347 thisfile = SH_ALLOC(sizeof(struct sh_logfile));
348
349 thisfile->filename = filename;
350 if (0 == strcmp(splits[0], _("SHELL")))
351 thisfile->flags = SH_LOGFILE_NOFILE;
352 else
353 thisfile->flags = SH_LOGFILE_REWIND;
354 thisfile->inode = 0;
355 thisfile->device_id = 0;
356 thisfile->fp = NULL;
357 if (log_type->get_record)
358 thisfile->get_record = log_type->get_record;
359 else
360 thisfile->get_record = sh_default_reader;
361 thisfile->parse_record = log_type->parse_record;
362
363 /* An optional regex for parsing the file. The result
364 * 'fileinfo' should contain info about host/time position.
365 */
366 if (log_type->eval_fileinfo)
367 {
368 if (nfields == 3 && lengths[2] > 0)
369 {
370 thisfile->fileinfo = log_type->eval_fileinfo(splits[2]);
371
372 if (thisfile->fileinfo == NULL)
373 {
374 sh_string * msg = sh_string_new(0);
375 sh_string_add_from_char(msg, _("Logfile format description not recognized: "));
376 sh_string_add_from_char(msg, splits[2]);
377
378 SH_MUTEX_LOCK(mutex_thread_nolog);
379 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
380 sh_string_str(msg),
381 _("sh_add_watch"));
382 SH_MUTEX_UNLOCK(mutex_thread_nolog);
383 sh_string_destroy(&msg);
384
385 SH_FREE(filename);
386 SH_FREE(thisfile);
387 SH_FREE(new);
388 return -1;
389 }
390 }
391 else
392 {
393 sh_string * msg = sh_string_new(0);
394 sh_string_add_from_char(msg, _("Logfile format description missing: "));
395 sh_string_add_from_char(msg, splits[1]);
396
397 SH_MUTEX_LOCK(mutex_thread_nolog);
398 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
399 sh_string_str(msg),
400 _("sh_add_watch"));
401 SH_MUTEX_UNLOCK(mutex_thread_nolog);
402 sh_string_destroy(&msg);
403
404 SH_FREE(filename);
405 SH_FREE(thisfile);
406 SH_FREE(new);
407 return -1;
408 }
409 }
410 else
411 {
412 thisfile->fileinfo = NULL;
413 }
414 thisfile->next = sh_watched_logs;
415
416 /* Try reading saved offset. On success clear rewind flag.
417 */
418 if ((thisfile->flags & SH_LOGFILE_NOFILE) == 0)
419 {
420 if (0 == stat(thisfile->filename, &buf))
421 {
422 if (S_ISREG(buf.st_mode)
423#ifdef S_ISLNK
424 || S_ISLNK(buf.st_mode)
425#endif
426 )
427 {
428 thisfile->inode = buf.st_ino;
429 thisfile->device_id = buf.st_dev;
430
431 if (0 != read_pos(thisfile))
432 {
433 thisfile->flags &= ~SH_LOGFILE_REWIND;
434 }
435 }
436 else if (S_ISFIFO(buf.st_mode))
437 {
438 thisfile->inode = buf.st_ino;
439 thisfile->device_id = buf.st_dev;
440 thisfile->flags |= SH_LOGFILE_PIPE;
441 }
442 }
443 else
444 {
445 sh_string * msg = sh_string_new(0);
446 sh_string_add_from_char(msg, _("Logfile is not a regular file, link, or named pipe: "));
447 sh_string_add_from_char(msg, splits[1]);
448
449 SH_MUTEX_LOCK(mutex_thread_nolog);
450 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
451 sh_string_str(msg),
452 _("sh_add_watch"));
453 SH_MUTEX_UNLOCK(mutex_thread_nolog);
454 sh_string_destroy(&msg);
455
456 SH_FREE(filename);
457 SH_FREE(thisfile);
458 SH_FREE(new);
459 return -1;
460 }
461 }
462
463 sh_watched_logs = thisfile;
464
465 SH_FREE(new);
466 return 0;
467}
468
469void sh_dump_watches()
470{
471 struct sh_logfile * thisfile;
472
473 while (sh_watched_logs)
474 {
475 thisfile = sh_watched_logs;
476 sh_watched_logs = thisfile->next;
477
478 if ((thisfile->flags & SH_LOGFILE_NOFILE) == 0 &&
479 (thisfile->flags & SH_LOGFILE_PIPE) == 0)
480 {
481 save_pos(thisfile);
482 }
483
484 if ((thisfile->flags & SH_LOGFILE_NOFILE) == 0)
485 {
486 if (thisfile->fp)
487 sl_fclose(FIL__, __LINE__, thisfile->fp);
488 }
489
490 if (thisfile->filename)
491 SH_FREE(thisfile->filename);
492 SH_FREE(thisfile);
493 }
494 return;
495}
496
497/* This variable is not used anywhere. It only exist
498 * to assign &new to them, which keeps gcc from
499 * putting it into a register, and avoids the 'clobbered
500 * by longjmp' warning. And no, 'volatile' proved insufficient.
501 */
502static void * sh_dummy_thisfile = NULL;
503
504void sh_check_watches()
505{
506 struct sh_logrecord * logrecord;
507 struct sh_logfile * thisfile = sh_watched_logs;
508 sh_string * record = sh_string_new(0);
509 char * tmp;
510
511 /* Take the address to keep gcc from putting them into registers.
512 * Avoids the 'clobbered by longjmp' warning.
513 */
514 sh_dummy_thisfile = (void*) &thisfile;
515
516 while (thisfile)
517 {
518 volatile size_t count = 0;
519
520 SH_MUTEX_LOCK(mutex_thread_nolog);
521 tmp = sh_util_safe_name (thisfile->filename);
522 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_CHKS,
523 tmp);
524 SH_FREE(tmp);
525 SH_MUTEX_UNLOCK(mutex_thread_nolog);
526
527 for (;;) {
528
529 record = thisfile->get_record(record, thisfile);
530
531 if (record)
532 {
533 logrecord = thisfile->parse_record(record, thisfile->fileinfo);
534 ++count;
535
536 if (logrecord)
537 {
538 logrecord->filename = thisfile->filename;
539
540 /* Don't report if 'init', just set file pointer
541 */
542 if (sh.flag.checkSum != SH_CHECK_INIT)
543 {
544 sh_eval_process_msg(logrecord);
545 }
546
547 if (logrecord->message)
548 sh_string_destroy(&(logrecord->message));
549 if (logrecord->host)
550 sh_string_destroy(&(logrecord->host));
551 if (logrecord->timestr)
552 sh_string_destroy(&(logrecord->timestr));
553 SH_FREE(logrecord);
554 }
555 }
556 else
557 {
558 record = sh_string_new(0);
559 break;
560 }
561 }
562
563 SH_MUTEX_LOCK(mutex_thread_nolog);
564 tmp = sh_util_safe_name (thisfile->filename);
565 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_CHKE,
566 tmp, (unsigned long)count);
567 SH_FREE(tmp);
568 SH_MUTEX_UNLOCK(mutex_thread_nolog);
569
570 thisfile = thisfile->next;
571 }
572 sh_string_destroy(&record);
573 return;
574}
575
576/********************************************************
577 * Search rotated logfile
578 */
579#include <unistd.h>
580#include <libgen.h>
581#include <dirent.h>
582
583char * sh_rotated_log_search(const char * path, struct stat * buf)
584{
585
586 size_t size;
587 int i;
588 char * searchpath;
589 struct stat sbuf;
590 DIR * dp;
591 char * dname;
592 char * bname;
593
594 dname = sh_util_dirname(path);
595 bname = sh_util_basename(path);
596
597 size = strlen(dname) + strlen(bname) + 4;
598 searchpath = SH_ALLOC(size);
599
600 for (i = 0; i < 2; ++i)
601 {
602 snprintf(searchpath, size, "%s/%s.%1d", dname, bname, i);
603 if (0 == stat(searchpath, &sbuf) && sbuf.st_ino == buf->st_ino)
604 {
605 SH_FREE(dname);
606 SH_FREE(bname);
607 return searchpath;
608 }
609 }
610
611 SH_FREE(searchpath);
612
613 if (NULL != (dp = opendir(dname)))
614 {
615 struct dirent * de;
616
617 while (NULL != (de = readdir(dp)))
618 {
619 if (0 == strcmp(de->d_name, ".") || 0 == strcmp(de->d_name, ".."))
620 continue;
621
622 size = strlen(dname) + strlen(de->d_name) + 2;
623 searchpath = SH_ALLOC(size);
624 snprintf(searchpath, size, "%s/%s", dname, de->d_name);
625
626 if (0 == stat(searchpath, &sbuf) && sbuf.st_ino == buf->st_ino)
627 {
628 SH_FREE(dname);
629 SH_FREE(bname);
630 closedir(dp);
631 return searchpath;
632 }
633
634 SH_FREE(searchpath);
635 }
636 closedir(dp);
637 }
638
639 SH_FREE(dname);
640 SH_FREE(bname);
641
642 return NULL;
643}
644
645/* Open file, position at stored offset
646 */
647int sh_open_for_reader (struct sh_logfile * logfile)
648{
649 struct stat buf;
650 sh_string * filename;
651
652 /* check whether file exists, get inode to check for
653 * logfile rotation
654 */
655 if (0 != retry_stat(FIL__, __LINE__, logfile->filename, &buf))
656 {
657 char * tmp;
658
659 SH_MUTEX_LOCK(mutex_thread_nolog);
660 tmp = sh_util_safe_name (logfile->filename);
661 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_MISS,
662 tmp);
663 SH_FREE(tmp);
664 SH_MUTEX_UNLOCK(mutex_thread_nolog);
665
666 memset (&(logfile->offset), '\0', sizeof(fpos_t));
667 logfile->flags |= SH_LOGFILE_REWIND;
668 return 0;
669 }
670
671 filename = sh_string_new(0);
672 (void) sh_string_set_from_char (filename, logfile->filename);
673
674 /* detect and handle logfile rotation
675 */
676 if (logfile->inode != buf.st_ino &&
677 logfile->inode != 0 &&
678 !S_ISFIFO(buf.st_mode))
679 {
680 /* Case 1) We have dealt with the moved file already.
681 * Clear the moved flag, set the rewind flag,
682 * fix logfile->inode.
683 */
684 if ((logfile->flags & SH_LOGFILE_MOVED) != 0)
685 {
686 /* done with rotated file, start with current file
687 */
688 memset (&(logfile->offset), '\0', sizeof(fpos_t));
689 logfile->flags |= SH_LOGFILE_REWIND;
690 logfile->flags &= ~SH_LOGFILE_MOVED;
691 logfile->inode = buf.st_ino;
692 logfile->device_id = buf.st_dev;
693 }
694
695 /* Case 2) Searching for rotated file.
696 * If found: set the moved flag, fix path for fopen.
697 * If not found: set the rewind flag, fix logfile->inode.
698 */
699 else
700 {
701 char *oldfile = sh_rotated_log_search(logfile->filename, &buf);
702
703 if (NULL != oldfile)
704 {
705 (void) sh_string_set_from_char (filename, oldfile);
706 SH_FREE(oldfile);
707 logfile->flags |= SH_LOGFILE_MOVED;
708 }
709 else
710 {
711 memset (&(logfile->offset), '\0', sizeof(fpos_t));
712 logfile->flags |= SH_LOGFILE_REWIND;
713 logfile->inode = buf.st_ino;
714 logfile->device_id = buf.st_dev;
715 }
716 }
717 }
718
719 /* open file
720 */
721 if (!S_ISFIFO(buf.st_mode))
722 {
723 logfile->fp = fopen(filename->str, "r");
724 }
725 else
726 {
727 int fd_temp = open (filename->str, O_RDONLY|O_NONBLOCK);
728
729 if (fd_temp >= 0)
730 {
731 logfile->fp = fdopen(fd_temp, "r");
732 }
733 }
734
735 if (!logfile->fp)
736 {
737 char * tmp;
738
739 SH_MUTEX_LOCK(mutex_thread_nolog);
740 tmp = sh_util_safe_name (logfile->filename);
741 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_EOPEN,
742 tmp);
743 SH_FREE(tmp);
744 SH_MUTEX_UNLOCK(mutex_thread_nolog);
745
746 sh_string_destroy(&filename);
747 return 0;
748 }
749
750 sh_string_destroy(&filename);
751
752 if ((logfile->flags & SH_LOGFILE_PIPE) == 0)
753 {
754 if ((logfile->flags & SH_LOGFILE_REWIND) != 0)
755 {
756 rewind(logfile->fp);
757 fgetpos(logfile->fp, &(logfile->offset));
758 logfile->flags &= ~SH_LOGFILE_REWIND;
759 }
760 else
761 {
762 /* file too short
763 */
764 if (0 != fsetpos(logfile->fp, &(logfile->offset)))
765 {
766 rewind(logfile->fp);
767 fgetpos(logfile->fp, &(logfile->offset));
768 }
769 }
770 }
771
772 return 1;
773}
774
775/******************************************************
776 * Default reader for ascii text files
777 */
778sh_string * sh_default_reader (sh_string * s, struct sh_logfile * logfile)
779{
780 volatile int status;
781 char * tmp;
782
783 start_read:
784
785 if (logfile->fp)
786 {
787 /* Result cannot be larger than 8192, thus cast is ok
788 */
789 status = (int) sh_string_read(s, logfile->fp, 8192);
790 if (status <= 0)
791 {
792 fgetpos(logfile->fp, &(logfile->offset));
793 sl_fclose(FIL__, __LINE__, logfile->fp);
794 logfile->fp = NULL;
795 sh_string_destroy(&s);
796 if (status == 0 || (logfile->flags & SH_LOGFILE_PIPE) != 0)
797 {
798 return NULL;
799 }
800
801 SH_MUTEX_LOCK(mutex_thread_nolog);
802 tmp = sh_util_safe_name (logfile->filename);
803 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_EREAD,
804 tmp);
805 SH_FREE(tmp);
806 SH_MUTEX_UNLOCK(mutex_thread_nolog);
807
808 return NULL;
809 }
810 return s;
811 }
812
813 if (0 != sh_open_for_reader(logfile))
814 goto start_read;
815
816 return NULL;
817}
818
819struct task_entry
820{
821 sh_tas_t task;
822 struct task_entry * next;
823};
824
825static struct task_entry * tasklist = NULL;
826
827static struct task_entry * task_find(FILE * fp)
828{
829 struct task_entry * entry = tasklist;
830 while (entry)
831 {
832 if (entry->task.pipe == fp)
833 return (entry);
834 entry = entry->next;
835 }
836 return NULL;
837}
838
839static void task_remove(struct task_entry * task)
840{
841 struct task_entry * entry = tasklist;
842 struct task_entry * prev = tasklist;
843
844 while (entry)
845 {
846 if (entry == task)
847 {
848 if (entry == tasklist)
849 {
850 tasklist = entry->next;
851 SH_FREE(entry);
852 return;
853 }
854 else
855 {
856 prev->next = entry->next;
857 SH_FREE(entry);
858 return;
859 }
860 }
861 prev = entry;
862 entry = entry->next;
863 }
864 return;
865}
866
867static void task_add(struct task_entry * entry)
868{
869 entry->next = tasklist;
870 tasklist = entry;
871 return;
872}
873
874sh_string * sh_command_reader (sh_string * s, struct sh_logfile * logfile)
875{
876 struct task_entry * entry;
877
878 struct sigaction new_act;
879 struct sigaction old_act;
880
881 volatile int status;
882 char * tmp;
883
884 start_read:
885
886 if (logfile->fp)
887 {
888 /* ignore SIGPIPE (instead get EPIPE if connection is closed)
889 */
890 memset(&new_act, 0, sizeof(struct sigaction));
891 new_act.sa_handler = SIG_IGN;
892 (void) retry_sigaction (FIL__, __LINE__, SIGPIPE, &new_act, &old_act);
893
894 /* Result cannot be larger than 8192, thus cast is ok
895 */
896 status = (int) sh_string_read(s, logfile->fp, 8192);
897
898 /* fprintf(stderr, "FIXME: %s\n", sh_string_str(s)); */
899
900 /* restore old signal handler
901 */
902 (void) retry_sigaction (FIL__, __LINE__, SIGPIPE, &old_act, NULL);
903
904 if (status <= 0)
905 {
906 entry = task_find(logfile->fp);
907 sh_ext_pclose (&(entry->task));
908 task_remove(entry);
909
910 logfile->fp = NULL;
911 sh_string_destroy(&s);
912
913 if (status == 0)
914 {
915 return NULL;
916 }
917
918 SH_MUTEX_LOCK(mutex_thread_nolog);
919 tmp = sh_util_safe_name (logfile->filename);
920 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_EREAD,
921 tmp);
922 SH_FREE(tmp);
923 SH_MUTEX_UNLOCK(mutex_thread_nolog);
924
925 return NULL;
926 }
927 return s;
928 }
929
930 entry = SH_ALLOC(sizeof(struct task_entry));
931
932 status = sh_ext_popen_init (&(entry->task), logfile->filename);
933 if (0 == status)
934 {
935 task_add(entry);
936 logfile->fp = entry->task.pipe;
937 goto start_read;
938 }
939 else
940 {
941 SH_FREE(entry);
942 SH_MUTEX_LOCK(mutex_thread_nolog);
943 sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, status, MSG_E_SUBGEN,
944 _("Could not open pipe"), _("sh_command reader"));
945 SH_MUTEX_UNLOCK(mutex_thread_nolog);
946 }
947
948 return NULL;
949}
950
951/******************************************************
952 * Reader for continued text files
953 */
954sh_string * sh_cont_reader (sh_string * s, struct sh_logfile * logfile, char*cont)
955{
956 int status;
957 char * tmp;
958 sh_string * str;
959 int remain = 8192;
960 int count = 0;
961
962 if (!sh_string_truncate(s, 0))
963 return NULL;
964
965 start_read:
966
967 if (logfile->fp)
968 {
969 str = sh_string_new(0);
970
971 /* Result cannot be larger than 8192, thus cast is ok
972 */
973 status = (int) sh_string_read(str, logfile->fp, 8192);
974
975 if (status > 0)
976 {
977
978 do {
979 s = sh_string_add (s, str);
980 count += status;
981 remain -= status;
982
983 if (remain <= 0)
984 {
985 return s;
986 }
987
988 status = (int) sh_string_read_cont(str, logfile->fp, count, cont);
989
990 if (status == 0)
991 {
992 return s;
993 }
994 }
995 while (status > 0);
996 }
997
998 if (status <= 0)
999 {
1000 fgetpos(logfile->fp, &(logfile->offset));
1001 sl_fclose(FIL__, __LINE__, logfile->fp);
1002 logfile->fp = NULL;
1003 sh_string_destroy(&s);
1004 if (status == 0 || (logfile->flags & SH_LOGFILE_PIPE) != 0)
1005 {
1006 return NULL;
1007 }
1008
1009 SH_MUTEX_LOCK(mutex_thread_nolog);
1010 tmp = sh_util_safe_name (logfile->filename);
1011 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_EREAD,
1012 tmp);
1013 SH_FREE(tmp);
1014 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1015
1016 return NULL;
1017 }
1018
1019 return s;
1020 }
1021
1022 if (0 != sh_open_for_reader(logfile))
1023 goto start_read;
1024
1025 return NULL;
1026}
1027
1028/******************************************************
1029 * Reader for binary files
1030 */
1031sh_string * sh_binary_reader (void * s, size_t size, struct sh_logfile * logfile)
1032{
1033 size_t status;
1034
1035 start_read:
1036
1037 if (logfile->fp)
1038 {
1039
1040 status = fread(s, size, 1, logfile->fp);
1041
1042 if (status != 1)
1043 {
1044 if (ferror(logfile->fp) && (logfile->flags & SH_LOGFILE_PIPE) == 0)
1045 {
1046 char * tmp;
1047 SH_MUTEX_LOCK(mutex_thread_nolog);
1048 tmp = sh_util_safe_name (logfile->filename);
1049 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_LOGMON_EREAD,
1050 tmp);
1051 SH_FREE(tmp);
1052 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1053 }
1054 fgetpos(logfile->fp, &(logfile->offset));
1055 sl_fclose(FIL__, __LINE__, logfile->fp);
1056 logfile->fp = NULL;
1057 memset(s, '\0', size);
1058 return NULL;
1059 }
1060 return s;
1061 }
1062
1063 if (0 != sh_open_for_reader(logfile))
1064 goto start_read;
1065
1066 return NULL;
1067}
1068
1069
1070
1071/**********************************************************
1072 *
1073 * Utilities
1074 *
1075 **********************************************************/
1076
1077/* Return current year, unless that would result
1078 * in a date far in the future. If that happens,
1079 * return last year.
1080 */
1081static int year_guess (struct tm * btime)
1082{
1083 int year;
1084 struct tm ts;
1085 time_t now = time(NULL);
1086 time_t check;
1087
1088 memcpy(&ts, localtime(&now), sizeof(struct tm));
1089 year = ts.tm_year;
1090
1091 /* Check result to detect year wrap
1092 * (logfile entry from last year).
1093 */
1094 btime->tm_year = year;
1095 check = mktime(btime);
1096 if (check > (now + (86400*30)))
1097 --year;
1098
1099 return year;
1100}
1101
1102time_t conv_timestamp (struct tm * btime,
1103 struct tm * old_tm, time_t * old_time)
1104{
1105 time_t timestamp;
1106 long offtime;
1107
1108
1109 /* timestamp - mktime is slooow, thus cache result
1110 */
1111 if (btime->tm_isdst == old_tm->tm_isdst &&
1112 btime->tm_year == old_tm->tm_year &&
1113 btime->tm_mon == old_tm->tm_mon &&
1114 btime->tm_mday == old_tm->tm_mday)
1115 {
1116 offtime =
1117 (btime->tm_hour - old_tm->tm_hour) * 3600 +
1118 (btime->tm_min - old_tm->tm_min) * 60 +
1119 (btime->tm_sec - old_tm->tm_sec);
1120
1121 *old_time += offtime;
1122 memcpy(old_tm, btime, sizeof(struct tm));
1123 timestamp = *old_time;
1124 }
1125 else
1126 {
1127 int year_btime = btime->tm_year;
1128
1129 if (btime->tm_year == 0)
1130 btime->tm_year = year_guess(btime);
1131 timestamp = mktime(btime);
1132 btime->tm_year = year_btime;
1133
1134 *old_time = timestamp;
1135 memcpy(old_tm, btime, sizeof(struct tm));
1136 }
1137 return timestamp;
1138}
1139
1140/*********************************************************
1141 *
1142 * MODULE STUFF
1143 *
1144 *********************************************************/
1145#include "sh_modules.h"
1146
1147SH_MUTEX_STATIC(mutex_logmon_check, PTHREAD_MUTEX_INITIALIZER);
1148
1149static int ShLogmonActive = S_FALSE;
1150#define SH_LOGMON_INTERVAL 10
1151static time_t sh_logmon_interval = SH_LOGMON_INTERVAL;
1152
1153int sh_log_check_init (struct mod_type * arg)
1154{
1155#if !defined(HAVE_PTHREAD)
1156 (void) arg;
1157#endif
1158
1159 if (ShLogmonActive == S_FALSE)
1160 return SH_MOD_FAILED;
1161#ifdef HAVE_PTHREAD
1162 if (arg != NULL && arg->initval < 0 &&
1163 (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
1164 {
1165 if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
1166 return SH_MOD_THREAD;
1167 else
1168 return SH_MOD_FAILED;
1169 }
1170#endif
1171 if (sh_watched_logs != NULL)
1172 return 0;
1173
1174 return -1;
1175}
1176
1177int sh_log_check_timer(time_t tcurrent)
1178{
1179 static time_t lastcheck = 0;
1180
1181 SL_ENTER(_("sh_log_check_timer"));
1182 if ((time_t) (tcurrent - lastcheck) >= sh_logmon_interval)
1183 {
1184 lastcheck = tcurrent;
1185 SL_RETURN((-1), _("sh_log_check_timer"));
1186 }
1187 SL_RETURN(0, _("sh_log_check_timer"));
1188}
1189
1190
1191int sh_log_check_check(void)
1192{
1193 int status = 0;
1194
1195 SL_ENTER(_("sh_log_check_check"));
1196
1197 SH_MUTEX_LOCK(mutex_logmon_check);
1198
1199 status = 0;
1200
1201 if( ShLogmonActive != S_FALSE )
1202 {
1203 sh_check_watches();
1204 sh_keep_match();
1205 sh_log_mark_check();
1206 clean_dir();
1207 }
1208 SH_MUTEX_UNLOCK(mutex_logmon_check);
1209
1210 SL_RETURN(status, _("sh_log_check_check"));
1211}
1212
1213int sh_log_check_reconf(void)
1214{
1215 int status = 0;
1216
1217 SL_ENTER(_("sh_log_check_check"));
1218
1219 SH_MUTEX_LOCK(mutex_logmon_check);
1220
1221 ShLogmonActive = S_FALSE;
1222 sh_logmon_interval = SH_LOGMON_INTERVAL;
1223 sh_dump_watches();
1224 sh_eval_cleanup();
1225
1226 SH_MUTEX_UNLOCK(mutex_logmon_check);
1227
1228 SL_RETURN(status, _("sh_log_check_check"));
1229}
1230
1231int sh_log_check_cleanup(void)
1232{
1233 sh_log_mark_destroy();
1234 return sh_log_check_reconf();
1235}
1236
1237/********************* OPTIONS **********************/
1238
1239static int sh_logmon_set_active (const char *str);
1240static int sh_logmon_set_clean (const char *str);
1241static int sh_logmon_set_interval(const char *str);
1242static int sh_logmon_add_watch (const char * str);
1243static int sh_logmon_add_group (const char * str);
1244static int sh_logmon_end_group (const char * str);
1245static int sh_logmon_add_host (const char * str);
1246static int sh_logmon_end_host (const char * str);
1247static int sh_logmon_add_queue (const char * str);
1248static int sh_logmon_add_rule (const char * str);
1249extern int sh_set_hidepid(const char *s);
1250static int sh_logmon_set_save_dir(const char *s);
1251
1252sh_rconf sh_log_check_table[] = {
1253 {
1254 N_("logmonactive"),
1255 sh_logmon_set_active,
1256 },
1257 {
1258 N_("logmoninterval"),
1259 sh_logmon_set_interval,
1260 },
1261 {
1262 N_("logmonclean"),
1263 sh_logmon_set_clean,
1264 },
1265 {
1266 N_("logmonwatch"),
1267 sh_logmon_add_watch,
1268 },
1269 {
1270 N_("logmonqueue"),
1271 sh_logmon_add_queue,
1272 },
1273 {
1274 N_("logmongroup"),
1275 sh_logmon_add_group,
1276 },
1277 {
1278 N_("logmonendgroup"),
1279 sh_logmon_end_group,
1280 },
1281 {
1282 N_("logmonhost"),
1283 sh_logmon_add_host,
1284 },
1285 {
1286 N_("logmonendhost"),
1287 sh_logmon_end_host,
1288 },
1289 {
1290 N_("logmonrule"),
1291 sh_logmon_add_rule,
1292 },
1293 {
1294 N_("logmonhidepid"),
1295 sh_set_hidepid,
1296 },
1297 {
1298 N_("logmonsavedir"),
1299 sh_logmon_set_save_dir,
1300 },
1301 {
1302 N_("logmonmarkseverity"),
1303 sh_logmon_set_save_dir,
1304 },
1305 {
1306 N_("logmonburstthreshold"),
1307 sh_repeat_set_trigger,
1308 },
1309 {
1310 N_("logmonburstqueue"),
1311 sh_repeat_set_queue,
1312 },
1313 {
1314 N_("logmonburstcron"),
1315 sh_repeat_set_cron,
1316 },
1317 {
1318 NULL,
1319 NULL
1320 }
1321};
1322
1323/* Decide if we're active.
1324 */
1325static int sh_logmon_set_active(const char *str)
1326{
1327 int value;
1328
1329 SL_ENTER(_("sh_logmon_set_active"));
1330
1331 value = sh_util_flagval(str, &ShLogmonActive);
1332
1333 SL_RETURN((value), _("sh_logmon_set_active"));
1334}
1335
1336/* Decide if we're active.
1337 */
1338static int sh_logmon_set_clean(const char *str)
1339{
1340 int value;
1341
1342 SL_ENTER(_("sh_logmon_set_active"));
1343
1344 value = sh_util_flagval(str, &do_checkpoint_cleanup);
1345
1346 SL_RETURN((value), _("sh_logmon_set_active"));
1347}
1348
1349static int sh_logmon_set_save_dir(const char *str)
1350{
1351 int retval = -1;
1352
1353 SL_ENTER(_("sh_logmon_set_save_dir"));
1354
1355 if (str && str[0] == '/')
1356 {
1357 if (save_dir)
1358 {
1359 SH_FREE(save_dir);
1360 save_dir = NULL;
1361 }
1362 save_dir = sh_util_strdup(str);
1363 retval = 0;
1364 }
1365
1366 SL_RETURN((retval), _("sh_logmon_set_save_dir"));
1367}
1368
1369static int sh_logmon_set_interval (const char * c)
1370{
1371 int retval = 0;
1372 long val;
1373
1374 SL_ENTER(_("sh_logmon_set_interval"));
1375 val = strtol (c, (char **)NULL, 10);
1376 if (val <= 0)
1377 {
1378 SH_MUTEX_LOCK(mutex_thread_nolog);
1379 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
1380 _("log monitoring interval"), c);
1381 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1382 retval = -1;
1383 }
1384
1385 sh_logmon_interval = (time_t) val;
1386 SL_RETURN(0, _("sh_logmon_set_interval"));
1387}
1388
1389/* Add a watch on a logfile.
1390 * Format: TYPE : Filename [: File_Format]
1391 */
1392static int sh_logmon_add_watch (const char * str)
1393{
1394 return sh_add_watch(str);
1395}
1396
1397/* Add a host.
1398 * Format: Name_Regex
1399 */
1400static int sh_logmon_add_host (const char * str)
1401{
1402 return sh_eval_hadd(str);
1403}
1404
1405/* End a host.
1406 * Format: Name
1407 */
1408static int sh_logmon_end_host (const char * str)
1409{
1410 (void) str;
1411 return sh_eval_hend(NULL);
1412}
1413
1414/* Add a group of rules.
1415 * Groups can be under hosts, but not vice versa.
1416 * Format: Name : Prefix_Regex
1417 */
1418static int sh_logmon_add_group (const char * str)
1419{
1420 return sh_eval_gadd(str);
1421}
1422
1423/* End a group of rules.
1424 * Format: Name
1425 */
1426static int sh_logmon_end_group (const char * str)
1427{
1428 (void) str;
1429 return sh_eval_gend(NULL);
1430}
1431
1432/* Define a reporting queue.
1433 * Format: Label : [Interval] : TYPE : Severity[:alias]
1434 * TYPE must be 'report' or 'sum'
1435 * Interval is ignored for TYPE='report'
1436 */
1437static int sh_logmon_add_queue (const char * str)
1438{
1439 return sh_eval_qadd(str);
1440}
1441
1442/* Define a check rule.
1443 * Format: [KEEP(seconds,label):]Queue_Label : Regex
1444 * KEEP indicates that we keep the label, to perform
1445 * correlation matching
1446 */
1447static int sh_logmon_add_rule (const char * str)
1448{
1449 return sh_eval_radd(str);
1450}
1451
1452
1453#if 0
1454
1455/* >>>>>>>>>>> MAIN <<<<<<<<<<<<<<<<<<< */
1456
1457int main (int argc, char * argv[])
1458{
1459 int status, i;
1460 FILE * fp;
1461 sh_string * s = NULL;
1462 static char template[] = "/tmp/xtest.XXXXXX";
1463
1464 /* pacct */
1465 status = sh_add_watch("PACCT:/var/log/account/pacct");
1466 sh_check_watches();
1467 sh_dump_watches();
1468 exit(0);
1469
1470 /* apache log */
1471 sh_eval_gadd("four_o_four:404");
1472 sh_eval_qadd("test:1:sum:7");
1473 sh_eval_radd("test:^(\\d+.\\d+.\\d+.\\d+).*");
1474 sh_eval_gend(NULL);
1475 sh_eval_radd("trash:.*");
1476 status = sh_add_watch("APACHE:/var/log/apache2/access.log:combined");
1477 sh_check_watches();
1478 sh_dump_watches();
1479 exit(0);
1480
1481 /* logfile */
1482 sh_set_hidepid(1);
1483 sh_eval_hadd("hslxmsrv1");
1484 sh_eval_gadd("postfix:postfix");
1485 sh_eval_qadd("test::report:7");
1486 sh_eval_radd("test:postfix/smtpd: disconnect from localhost.*");
1487 sh_eval_radd("trash:postfix/smtpd: disconnect.*");
1488 sh_eval_hadd("hspc05");
1489 sh_eval_gadd("cron:CRON");
1490 sh_eval_qadd("test:1:sum:7");
1491 sh_eval_radd("test:CRON: PAM adding faulty module: (/lib/security/.*.so)");
1492 sh_eval_radd("trash:.*");
1493 status = sh_add_watch("SYSLOG:/var/log/messages");
1494 sh_check_watches();
1495
1496 sh_dump_watches();
1497 exit(0);
1498
1499 printf("%d types\n",
1500 (int) (sizeof(sh_logtypes_def)/sizeof(struct sh_logfile_type)));
1501
1502 /* test sh_add_watch
1503 */
1504 status = sh_add_watch("");
1505 printf("%2d: zero length, expect -1\n", status);
1506 status = sh_add_watch(NULL);
1507 printf("%2d: NULL, expect -2\n", status);
1508 status = sh_add_watch("0123456789012345:/var/log/messages");
1509 printf("%2d: long, expect -2\n", status);
1510 status = sh_add_watch("012345678901234:/var/log/messages");
1511 printf("%2d: exact length, expect -3\n", status);
1512 status = sh_add_watch("01234567890123:56789");
1513 printf("%2d: short length, expect -3\n", status);
1514 status = sh_add_watch("SYSLOG:var/log/messages");
1515 printf("%2d: short badpath, expect -4\n", status);
1516 status = sh_add_watch("SYSLOG:/var/log/messages");
1517 /* status = sh_add_watch("SYSLOG:/var/log/dpkg.log.1"); */
1518 printf("%2d: short path ok, expect 0\n", status);
1519
1520 /* test sh_string_read
1521 */
1522 s = sh_string_new();
1523
1524 status = /*@i@*/mkstemp(template);
1525
1526 if (status < 0) {
1527 fprintf(stderr, "error in mkstemp!\n"); exit(EXIT_FAILURE); }
1528
1529 fp = fdopen(status, "r+");
1530 if (!fp) {
1531 fprintf(stderr, "error in fdopen!\n"); exit(EXIT_FAILURE); }
1532
1533 for (i = 0; i < 80; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 0 */
1534 for (i = 0; i < 118; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 1 */
1535 for (i = 0; i < 119; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 2 */
1536 for (i = 0; i < 120; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 3 */
1537 for (i = 0; i < 121; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 4 */
1538 for (i = 0; i < 238; ++i) { fputc ('a', fp); } fputc ('\n', fp);
1539 for (i = 0; i < 239; ++i) { fputc ('a', fp); } fputc ('\n', fp);
1540 for (i = 0; i < 240; ++i) { fputc ('a', fp); } fputc ('\n', fp);
1541 for (i = 0; i < 241; ++i) { fputc ('a', fp); } fputc ('\n', fp);
1542
1543 rewind(fp);
1544
1545 for (i = 0; i < 9; ++i)
1546 {
1547 status = (int) sh_string_read(s, fp, 120);
1548 printf("%d: status = %d, len = %d, size = %d\n",
1549 i, status, (int)s->len, (int)s->siz);
1550 if (status == -2)
1551 (void) sh_string_read(s, fp, 240);
1552 else
1553 printf("%s\n", s->str);
1554 }
1555
1556 rewind(fp);
1557
1558 (void) sh_string_truncate(s, 0);
1559
1560 for (i = 0; i < 9; ++i)
1561 {
1562 status = (int) sh_string_read(s, fp, 240);
1563 printf("%d: status = %d, len = %d, size = %d\n",
1564 i, status, (int)s->len, (int)s->siz);
1565 if (status == -2)
1566 (void) sh_string_read(s, fp, 240);
1567 else
1568 {
1569 for (status = 0; status < (int)s->len; ++status)
1570 {
1571 if (s->str[status] != 'a')
1572 {
1573 break;
1574 }
1575 }
1576 printf("%d %s\n", status, s->str);
1577 }
1578 }
1579
1580 sl_fclose(FIL__, __LINE__, fp); remove(template);
1581
1582
1583
1584 return 0;
1585}
1586#endif
1587
1588/* #ifdef USE_LOGFILE_MONITOR */
1589#endif
1590
Note: See TracBrowser for help on using the repository browser.