Changeset 357

Timestamp:

Sep 19, 2011, 8:27:45 PM (13 years ago)

Author:

katerina

Message:

Fix for ticket #263 (log correlation may not work).

Location:

trunk

Files:

• docs/Changelog (modified) (1 diff)
• src/sh_log_check.c (modified) (3 diffs)
• src/sh_log_correlate.c (modified) (6 diffs)
• src/sh_log_evalrule.c (modified) (1 diff)
• src/sh_log_parse_apache.c (modified) (1 diff)
• src/sh_log_parse_samba.c (modified) (1 diff)
• src/sh_log_parse_syslog.c (modified) (1 diff)

trunk/docs/Changelog

@@ -1 +1 @@
 2.8.6:
+        * Fix problems with timestamp handling in logfile correlation
+          (problem reported by D. Dearmore)
         * List the policy under which a directory/file is checked
         * Option to use a textfile with a list of files for update

trunk/src/sh_log_check.c

@@ -896 +896 @@
       status = (int) sh_string_read(s, logfile->fp, 8192);
 
-      /* fprintf(stderr, "FIXME: %s\n", sh_string_str(s)); */
-
       /* restore old signal handler
        */
@@ -1106 +1104 @@
   long   offtime;
 
-
   /* timestamp - mktime is slooow, thus cache result
    */
@@ -1131 +1128 @@
       timestamp = mktime(btime);
       btime->tm_year = year_btime;
-
       *old_time  = timestamp;
       memcpy(old_tm, btime, sizeof(struct tm));

trunk/src/sh_log_correlate.c

@@ -57 +57 @@
 {
   struct sh_keep * keep = (struct sh_keep *) item;
+
   if (!keep)
     return;
@@ -125 +126 @@
       while (count < keepcount && keep)
         {
-          if ((now > keep->last) && 
+          if ((now >= keep->last) && 
               ((unsigned long)(now - keep->last) <= keep->delay))
             {
@@ -163 +164 @@
       SH_FREE(arr);
     }
+
   return res;
 }
@@ -172 +174 @@
   sh_string       * label;           /* label of match rule     */
   pcre            * rule;            /* compiled regex for rule */
+  time_t            reported;        /* last reported           */
   struct sh_qeval * queue;           /* assigned queue          */
   struct sh_mkeep * next; 
@@ -232 +235 @@
       mkeep->queue = rqueue;
       mkeep->label = sh_string_new_from_lchar(splits[0], strlen(splits[0]));
+      mkeep->reported = 0;
       mkeep->next  = mkeep_list;
       mkeep_list   = mkeep;
@@ -297 +301 @@
                 {
                   sh_string * alias;
-                  SH_MUTEX_LOCK(mutex_thread_nolog);
-                  sh_error_handle (mkeep->queue->severity, FIL__, __LINE__, 0, 
-                                   MSG_LOGMON_COR, sh_string_str(mkeep->label),
-                                   val);
-
-                  alias = mkeep->queue->alias;
-                  if (alias)
+                  time_t      now = time(NULL);
+
+                  if ((mkeep->reported < now) &&
+                      (60 < (now - mkeep->reported)))
                     {
-                      sh_error_mail (sh_string_str(alias), 
-                                     mkeep->queue->severity, FIL__, __LINE__, 0, 
-                                     MSG_LOGMON_COR, sh_string_str(mkeep->label),
-                                     val);
+                      mkeep->reported = now;
+
+                      SH_MUTEX_LOCK(mutex_thread_nolog);
+                      sh_error_handle (mkeep->queue->severity, FIL__, __LINE__, 0, 
+                                       MSG_LOGMON_COR, sh_string_str(mkeep->label),
+                                       val);
+
+                      alias = mkeep->queue->alias;
+                      if (alias)
+                        {
+                          sh_error_mail (sh_string_str(alias), 
+                                         mkeep->queue->severity, FIL__, __LINE__, 0, 
+                                         MSG_LOGMON_COR, sh_string_str(mkeep->label),
+                                         val);
+                        }
+                      
+                      SH_MUTEX_UNLOCK(mutex_thread_nolog);
                     }
-                  
-                  SH_MUTEX_UNLOCK(mutex_thread_nolog);
                 }
               mkeep = mkeep->next;

trunk/src/sh_log_evalrule.c

@@ -885 +885 @@
             if ( rule->flags & RFL_KEEP )
               {
-                DEBUG("debug: rule %d matches (keep)\n", count);
+                DEBUG("debug: rule %d matches (keep), timestamp = %lu\n", count, timestamp);
                 sh_keep_add(rule->label, rule->delay, 
                             timestamp == 0 ? time(NULL) : timestamp);

trunk/src/sh_log_parse_apache.c

@@ -351 +351 @@
           struct tm btime;
           char * ptr = NULL;
+
+          memset(&btime, '\0', sizeof(struct tm));
+          btime.tm_isdst = -1;
           
           /* example: 01/Jun/2008:07:55:28 +0200 */

trunk/src/sh_log_parse_samba.c

@@ -76 +76 @@
 
           memset(&btime, '\0', sizeof(struct tm));
+          btime.tm_isdst = -1;
+
           ptr = strptime(sh_string_str(logline), format_1, &btime);
 

trunk/src/sh_log_parse_syslog.c

@@ -95 +95 @@
 
       memset(&btime, '\0', sizeof(struct tm));
+      btime.tm_isdst = -1;
 
       /* This is RFC 3164.