diff --git a/src/classes/logstreamlineparsersyslog23.class.php b/src/classes/logstreamlineparsersyslog23.class.php new file mode 100644 index 0000000..0f99396 --- /dev/null +++ b/src/classes/logstreamlineparsersyslog23.class.php @@ -0,0 +1,130 @@ +. + * + * A copy of the GPL can be found in the file "COPYING" in this + * distribution. + ********************************************************************* +*/ + +// --- Avoid directly accessing this file! +if ( !defined('IN_PHPLOGCON') ) +{ + die('Hacking attempt'); + exit; +} +// --- + +// --- Basic Includes +require_once($gl_root_path . 'classes/enums.class.php'); +require_once($gl_root_path . 'include/constants_errors.php'); +require_once($gl_root_path . 'include/constants_logstream.php'); +// --- + + +class LogStreamLineParsersyslog23 extends LogStreamLineParser { +// protected $_arrProperties = null; + + // Constructor + public function LogStreamLineParsersyslog23() { + return; // Nothing + } + + /** + * ParseLine + * + * @param arrArguments array in&out: properties of interest. There can be no guarantee the logstream can actually deliver them. + * @return integer Error stat + */ + public function ParseLine($szLine, &$arrArguments) + { + // Set IUT Property first! + $arrArguments[SYSLOG_MESSAGETYPE] = IUT_Syslog; + + // Sample: <22>1 2011-03-03T15:27:06+01:00 debian507x64 postfix 2454 - - daemon started -- version 2.5.5, configuration /etc/postfix + // Sample: <46>1 2011-03-03T15:27:05+01:00 debian507x64 rsyslogd - - - [origin software="rsyslogd" swVersion="4.6.4" x-pid="2344" x-info="http://www.rsyslog.com"] (re)start + // Sample (RSyslog): 2008-03-28T11:07:40+01:00 localhost rger: test 1 + if ( preg_match("/<([0-9]{1,3})>([0-9]) ([0-9]{4,4}-[0-9]{1,2}-[0-9]{1,2}T[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}.[0-9]{1,2}:[0-9]{1,2}) (.*?) (.*?) (.*?) (.*?) (.*?) (.*?)$/", $szLine, $out ) ) + { + // Copy parsed properties! + $arrArguments[SYSLOG_FACILITY] = $out[1] >> 3; + $arrArguments[SYSLOG_SEVERITY] = $out[1] & 0x0007; + $arrArguments[SYSLOG_DATE] = GetEventTime($out[3]); + $arrArguments[SYSLOG_HOST] = $out[4]; + $arrArguments[SYSLOG_SYSLOGTAG] = $out[5]; + $arrArguments[SYSLOG_PROCESSID] = $out[6]; + $arrArguments[SYSLOG_MESSAGE] = $out[9]; + } + // Sample: <22>1 2011-03-03T15:27:06.501740+01:00 debian507x64 postfix 2454 - - daemon started -- version 2.5.5, configuration /etc/postfix + // Sample: <46>1 2011-03-03T15:27:05.366981+01:00 debian507x64 rsyslogd - - - [origin software="rsyslogd" swVersion="4.6.4" x-pid="2344" x-info="http://www.rsyslog.com"] (re)start + else if ( preg_match("/<([0-9]{1,3})>([0-9]) ([0-9]{4,4}-[0-9]{1,2}-[0-9]{1,2}T[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}\.[0-9]{1,6}.[0-9]{1,2}:[0-9]{1,2}) (.*?) (.*?) (.*?) (.*?) (.*?) (.*?)$/", $szLine, $out ) ) + { + // Copy parsed properties! + $arrArguments[SYSLOG_FACILITY] = $out[1] >> 3; + $arrArguments[SYSLOG_SEVERITY] = $out[1] & 0x0007; + $arrArguments[SYSLOG_DATE] = GetEventTime($out[3]); + $arrArguments[SYSLOG_HOST] = $out[4]; + $arrArguments[SYSLOG_SYSLOGTAG] = $out[5]; + $arrArguments[SYSLOG_PROCESSID] = $out[6]; + $arrArguments[SYSLOG_MESSAGE] = $out[9]; + } +/* // Sample (RSyslog): 2008-03-28T11:07:40.591633+01:00 localhost rger: test 1 + else if ( preg_match("/([0-9]{4,4}-[0-9]{1,2}-[0-9]{1,2}T[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}\.[0-9]{1,6}.[0-9]{1,2}:[0-9]{1,2}) (.*?) (.*?):(.*?)$/", $szLine, $out ) ) + { + // Copy parsed properties! + $arrArguments[SYSLOG_DATE] = GetEventTime($out[1]); + $arrArguments[SYSLOG_HOST] = $out[2]; + $arrArguments[SYSLOG_SYSLOGTAG] = $out[3]; + $arrArguments[SYSLOG_MESSAGE] = $out[4]; + } + // Sample: 2008-03-28T15:17:05.480876+01:00,**NO MATCH** + else if ( preg_match("/([0-9]{4,4}-[0-9]{1,2}-[0-9]{1,2}T[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}\.[0-9]{1,6}.[0-9]{1,2}:[0-9]{1,2}),(.*?)$/", $szLine, $out ) ) + { + // Some kind of debug message or something ... + $arrArguments[SYSLOG_DATE] = GetEventTime($out[1]); + $arrArguments[SYSLOG_MESSAGE] = $out[2]; + } +*/ + else + { + if ( isset($arrArguments[SYSLOG_MESSAGE]) && strlen($arrArguments[SYSLOG_MESSAGE]) > 0 ) + OutputDebugMessage("Unparseable syslog msg - '" . $arrArguments[SYSLOG_MESSAGE] . "'", DEBUG_ERROR); + } + + // If SyslogTag is set, we check for MessageType! + if ( isset($arrArguments[SYSLOG_SYSLOGTAG]) ) + { + if ( strpos($arrArguments[SYSLOG_SYSLOGTAG], "EvntSLog" ) !== false ) + $arrArguments[SYSLOG_MESSAGETYPE] = IUT_NT_EventReport; + } + + // Return success! + return SUCCESS; + } + + +} + +?> \ No newline at end of file diff --git a/src/include/functions_common.php b/src/include/functions_common.php index 8c6e21a..fe2b52e 100644 --- a/src/include/functions_common.php +++ b/src/include/functions_common.php @@ -209,6 +209,7 @@ function CreateLogLineTypesList( $selectedType ) $content['LOGLINETYPES']["syslog"]['DisplayName'] = "Syslog / RSyslog"; if ( $selectedType == $content['LOGLINETYPES']["syslog"]['type'] ) { $content['LOGLINETYPES']["syslog"]['selected'] = "selected"; } else { $content['LOGLINETYPES']["syslog"]['selected'] = ""; } + // Adiscon Winsyslog $content['LOGLINETYPES']["winsyslog"]['type'] = "winsyslog"; $content['LOGLINETYPES']["winsyslog"]['DisplayName'] = "Adiscon WinSyslog"; @@ -218,6 +219,11 @@ function CreateLogLineTypesList( $selectedType ) $content['LOGLINETYPES']["misc"]['type'] = "misc"; $content['LOGLINETYPES']["misc"]['DisplayName'] = "Miscellaneous logfiles"; if ( $selectedType == $content['LOGLINETYPES']["misc"]['type'] ) { $content['LOGLINETYPES']["misc"]['selected'] = "selected"; } else { $content['LOGLINETYPES']["misc"]['selected'] = ""; } + + // RSyslog Format23 + $content['LOGLINETYPES']["syslog23"]['type'] = "syslog23"; + $content['LOGLINETYPES']["syslog23"]['DisplayName'] = "RSyslog Format23 (RFC 5424)"; + if ( $selectedType == $content['LOGLINETYPES']["syslog23"]['type'] ) { $content['LOGLINETYPES']["syslog23"]['selected'] = "selected"; } else { $content['LOGLINETYPES']["syslog23"]['selected'] = ""; } } function CreateSourceTypesList( $selectedSource )