404Forbiden

✏️ Editing: log_matcher.cpython-36.pyc

<+j������������������@���s<���d�dl�Z�d�dlmZmZ�d�dlZd�dlZG�dd��de�ZdS�)�����N)�datetime�	timedeltac���������������@���sT���e�Zd�ZdZdd��Zddd�Zddd�Zd	d
��Zdd��Ze	d
d���Z
e	dd���ZdS�)�
LogMatcherz5
    Handles the matching of filter in the logs.
    c�������������C���s
���||�_�dS�)zV
        @param file_creation: last known creation timestamp of the log file.
        N)�_inode)�self�inode��r����(/usr/lib/fm-agent/library/log_matcher.py�__init__���s����zLogMatcher.__init__Nc�������	���������s����|sg�}y|�j����W�n4�tk
rH���ddl}|j��\}}}tj|��g�S�X���fdd�}tt||��}|jt	j
��t|�f��|S�dS�)z�
        Match the ampount of times expression is present in lines,
        return the results with the new entry appended to it.

@param expression: String,
        @param lines: Iterable
        @param results: List of past results
        r���Nc����������������s���t�j��|��}|r|�pdS�)NF)�re�search)�line�match)�
expressionr���r	����
find_match'���s����z$LogMatcher.match.<locals>.find_match)�_valid_inode�
ValueError�sys�exc_info�logging�info�list�filter�appendr����now�len)	r����linesr����resultsr����_�errorr����
matched_linesr���)r���r	���r������s����	
zLogMatcher.matchc����������������s����|sg�}y|�j����W�n4�tk
rH���ddl}|j��\}}}tj|��g�S�X�dd��|D��}���fdd�}	tt|	|��}
|jt	j
��t|
�f��|S�)a���
        Return the number of lines that the where the column is
        equal to the expression by splitting the lines.

@param lines: Array of lines to split and search.
        @param expression: Regular expression to match agains the specified column
        @param column: Column number to separate from the regular line.
        @param results: List of past results
        r���Nc�������������S���s���g�|�]}|j����qS�r���)�split)�.0r
���r���r���r	����
<listcomp>C���s����z.LogMatcher.match_in_column.<locals>.<listcomp>c����������������s ���|����}t�j�|�}|r|�pdS�)NF)r���r���)r
���Z
data_pointr���)�columnr���r���r	���r���E���s����z.LogMatcher.match_in_column.<locals>.find_match)r���r���r���r���r���r���r���r���r���r���r���r���)r���r���r���r$���r���r���r���r���Zsplitted_linesr���r ���r���)r$���r���r	����match_in_column/���s����

zLogMatcher.match_in_columnc�������������C���s���|�j�dkrtd��dS�)z�
        Validate that we have an inode. If we dont
        that means we are running the check for the first time,
        and don't have enought information to calculate the matchs.
        NzInode is None. Returning None)r���r���)r���r���r���r	���r���N���s����
zLogMatcher._valid_inodec�������������C���s`���d}g�}x@|D�]8\}}t�j��|�}|t|d�k�r||7�}|j||f��qW�|�jsXdg�fS�||fS�)a���
        Check the results and the timescale to determine if a metric
        should be given. The delta between now and the last results time
        must be greater than the timescale to properly calculate the metric.

@param results: List of past results.
        @param timescale: Integer of the buffer size to take into
        consideration.
        @param last_results_time: Datetime
        r���)�minutesN)r���r���r���r���r���)r���r����	timescaleZ	total_sumZ
valid_results�	timestamp�result�deltar���r���r	����calculate_metricW���s����zLogMatcher.calculate_metricc�������	������C���sv���g�}d}d}t�|d�}|dkr:xt|�D�]\}}q(W�|}n,x&t|�D�]\}}||�krD|j|��qDW�|}|j���||fS�)z`
        Grab the lines from the last known line number to the
        end of the file.
        r����rN)�open�	enumerater����close)	Zlast_known_line_number�sourceZ
current_inode�stored_inodeZexpected_lines�index�total_linesZopened_filer
���r���r���r	����get_file_linesm���s����
zLogMatcher.get_file_linesc�������������C���s���t�j|��jS�)z1
        Grab the file created timstamp.
        )�os�stat�st_ino)r0���r���r���r	����get_file_inode����s����zLogMatcher.get_file_inode)N)N)�__name__�
__module__�__qualname__�__doc__r
���r���r%���r���r+����staticmethodr4���r8���r���r���r���r	���r������s���

r���)r���r���r���r���r5����objectr���r���r���r���r	����<module>���s���

Sid Gifari From Gifari Industries - BD Cyber Security Team