tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-26 03:09:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added MsgParsers for Apache and IIS logfiles

Browse Source 
Also added some more icons and fixed a few things related to the web logs
This commit is contained in:
Andre Lorbach 2008-09-18 12:22:03 +02:00
parent 8eff09613e
commit 5544b0e286
15 changed files with 399 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/classes/logstreamconfig.class.php
View File

@ -136,9 +136,11 @@ abstract class LogStreamConfig {
{
foreach( $this->_msgParserObjList as $myMsgParser )
{
// Perform Parsing, and return if was successfull! Otherwise the next Parser will be called.
if ( $myMsgParser->ParseMsg($szMsg, $arrArguments) == SUCCESS )
return SUCCESS;
// Perform Parsing, and return if was successfull or the message needs to be skipped!
// Otherwise the next Parser will be called.
$ret = $myMsgParser->ParseMsg($szMsg, $arrArguments);
if ( $ret == SUCCESS || $ret == ERROR_MSG_SKIPMESSAGE )
return $ret;
}
}

8
src/classes/logstreamdisk.class.php
View File

@ -237,10 +237,14 @@ class LogStreamDisk extends LogStream {
if ( $ret == SUCCESS && $bParseMessage)
{
// Line Parser Hook here
$this->_logStreamConfigObj->_lineParser->ParseLine($arrProperitesOut[SYSLOG_MESSAGE], $arrProperitesOut);
$retParser = $this->_logStreamConfigObj->_lineParser->ParseLine($arrProperitesOut[SYSLOG_MESSAGE], $arrProperitesOut);
// Run optional Message Parsers now
$this->_logStreamConfigObj->ProcessMsgParsers($arrProperitesOut[SYSLOG_MESSAGE], $arrProperitesOut);
$retParser = $this->_logStreamConfigObj->ProcessMsgParsers($arrProperitesOut[SYSLOG_MESSAGE], $arrProperitesOut);
// Check if we have to skip the message!
if ( $retParser == ERROR_MSG_SKIPMESSAGE )
$ret = $retParser;
// Set uID to the PropertiesOut!
$arrProperitesOut[SYSLOG_UID] = $uID;

77
src/classes/logstreamlineparsermisc.class.php Normal file
View File

@ -0,0 +1,77 @@
<?php
/*
*********************************************************************
* -> www.phplogcon.org <- *
* ----------------------------------------------------------------- *
* Dummy LogStream Parser Class for all other logfile types handeled
* by msg parsers
*
* All directives are explained within this file
*
* Copyright (C) 2008 Adiscon GmbH.
*
* This file is part of phpLogCon.
*
* PhpLogCon is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* PhpLogCon is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with phpLogCon. If not, see <http://www.gnu.org/licenses/>.
*
* A copy of the GPL can be found in the file "COPYING" in this
* distribution.
*********************************************************************
*/
// --- Avoid directly accessing this file!
if ( !defined('IN_PHPLOGCON') )
{
die('Hacking attempt');
exit;
}
// ---
// --- Basic Includes
require_once($gl_root_path . 'classes/enums.class.php');
require_once($gl_root_path . 'include/constants_errors.php');
require_once($gl_root_path . 'include/constants_logstream.php');
// ---
class LogStreamLineParsermisc extends LogStreamLineParser {
// protected $_arrProperties = null;
// Constructor
public function LogStreamLineParsermisc() {
return; // Nothing
}
/**
* ParseLine
*
* @param arrArguments array in&out: properties of interest. There can be no guarantee the logstream can actually deliver them.
* @return integer Error stat
*/
public function ParseLine($szLine, &$arrArguments)
{
// Set MSG Property
$arrArguments[SYSLOG_MESSAGE] = $szLine;
// Set IUT Property
$arrArguments[SYSLOG_MESSAGETYPE] = IUT_Unknown;
// Return success!
return SUCCESS;
}
}
?>

146
src/classes/msgparsers/msgparser.apache2.class.php Normal file
View File

@ -0,0 +1,146 @@
<?php
/*
*********************************************************************
* -> www.phplogcon.org <- *
* ----------------------------------------------------------------- *
* Apache Logfile Parser used to split WebLog fields if found
* in the msg
* *
* All directives are explained within this file *
*
* Copyright (C) 2008 Adiscon GmbH.
*
* This file is part of phpLogCon.
*
* PhpLogCon is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* PhpLogCon is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with phpLogCon. If not, see <http://www.gnu.org/licenses/>.
*
* A copy of the GPL can be found in the file "COPYING" in this
* distribution.
*********************************************************************
*/
// --- Avoid directly accessing this file!
if ( !defined('IN_PHPLOGCON') )
{
die('Hacking attempt');
exit;
}
// ---
// --- Basic Includes
require_once($gl_root_path . 'classes/enums.class.php');
require_once($gl_root_path . 'classes/msgparser.class.php');
require_once($gl_root_path . 'include/constants_errors.php');
require_once($gl_root_path . 'include/constants_logstream.php');
// ---
class MsgParser_apache2 extends MsgParser {
// protected $_arrProperties = null;
// Constructor
public function MsgParser_apache2() {
return; // Nothing
}
/**
* ParseLine
*
* @param arrArguments array in&out: properties of interest. There can be no guarantee the logstream can actually deliver them.
* @return integer Error stat
*/
public function ParseMsg($szMsg, &$arrArguments)
{
global $content, $fields;
//return ERROR_MSG_NOMATCH;
// LogFormat "%h %l %u %t \"%r\" %>s %b" common
// LogFormat "%{Referer}i -> %U" referer
// LogFormat "%{User-agent}i" agent
// LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
// Sample (apache2): 127.0.0.1 - - [14/Sep/2008:06:50:15 +0200] "GET / HTTP/1.0" 200 19023 "-" "VoilaBot link checker"
// Sample: 65.55.211.112 - - [16/Sep/2008:13:37:47 +0200] "GET /index.php?name=News&file=article&sid=1&theme=Printer HTTP/1.1" 200 4908 "-" "msnbot/1.1 (+http://search.msn.com/msnbot.htm)"
if ( preg_match('/(.|.*?) (.|.*?) (.|.*?) \[(.*?)\] "(.*?) (.*?) (.*?)" (.|[0-9]{1,12}) (.|[0-9]{1,12}) "(.|.*?)" "(.*?)("|)$/', $szMsg, $out ) )
{
// print_r ( $out );
// exit;
// Set generic properties
$arrArguments[SYSLOG_HOST] = $out[1];
$arrArguments[SYSLOG_DATE] = GetEventTime($out[4]);
// Set weblog specific properties!
$arrArguments[SYSLOG_WEBLOG_USER] = $out[3];
$arrArguments[SYSLOG_WEBLOG_METHOD] = $out[5];
if ( strpos($out[6], "?") === false )
{
$arrArguments[SYSLOG_WEBLOG_URL] = $out[6];
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= "";
}
else
{
$arrArguments[SYSLOG_WEBLOG_URL] = substr( $out[6], 0, strpos($out[6], "?"));
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= substr( $out[6], strpos($out[6], "?")+1 );
}
// $arrArguments[SYSLOG_WEBLOG_QUERYSTRING] = $out[7];
$arrArguments[SYSLOG_WEBLOG_PVER] = $out[7];
$arrArguments[SYSLOG_WEBLOG_STATUS] = $out[8];
$arrArguments[SYSLOG_WEBLOG_BYTESSEND] = $out[9];
$arrArguments[SYSLOG_WEBLOG_REFERER] = $out[10];
$arrArguments[SYSLOG_WEBLOG_USERAGENT] = $out[11];
// Set msg to whole logline
$arrArguments[SYSLOG_MESSAGE] = $out[0];
if ( $this->_MsgNormalize == 1 )
{
//Init tmp msg
$szTmpMsg = "";
// Create Field Array to prepend into msg! Reverse Order here
$myFields = array( SYSLOG_WEBLOG_USER, SYSLOG_WEBLOG_PVER, SYSLOG_WEBLOG_USERAGENT, SYSLOG_WEBLOG_BYTESSEND, SYSLOG_WEBLOG_STATUS, SYSLOG_WEBLOG_REFERER, SYSLOG_WEBLOG_METHOD, SYSLOG_WEBLOG_QUERYSTRING, SYSLOG_WEBLOG_URL );
foreach ( $myFields as $myField )
{
// Set Field Caption
if ( isset($content[ $fields[$myField]['FieldCaptionID'] ]) )
$szFieldName = $content[ $fields[$myField]['FieldCaptionID'] ];
else
$szFieldName = $fields[$myField]['FieldCaptionID'];
// Append Field into msg
$szTmpMsg = $szFieldName . ": '" . $arrArguments[$myField] . "'\n" . $szTmpMsg;
}
// copy finished MSG back!
$arrArguments[SYSLOG_MESSAGE] = $szTmpMsg;
}
}
else
{
// return no match in this case!
return ERROR_MSG_NOMATCH;
}
// Set IUT Property if success!
$arrArguments[SYSLOG_MESSAGETYPE] = IUT_APACHELOG;
// If we reached this position, return success!
return SUCCESS;
}
}
?>

142
src/classes/msgparsers/msgparser.iis.class.php Normal file
View File

@ -0,0 +1,142 @@
<?php
/*
*********************************************************************
* -> www.phplogcon.org <- *
* ----------------------------------------------------------------- *
* Microsoft IIS Logfile Parser used to split WebLog fields if found
* in the msg
* *
* All directives are explained within this file *
*
* Copyright (C) 2008 Adiscon GmbH.
*
* This file is part of phpLogCon.
*
* PhpLogCon is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* PhpLogCon is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with phpLogCon. If not, see <http://www.gnu.org/licenses/>.
*
* A copy of the GPL can be found in the file "COPYING" in this
* distribution.
*********************************************************************
*/
// --- Avoid directly accessing this file!
if ( !defined('IN_PHPLOGCON') )
{
die('Hacking attempt');
exit;
}
// ---
// --- Basic Includes
require_once($gl_root_path . 'classes/enums.class.php');
require_once($gl_root_path . 'classes/msgparser.class.php');
require_once($gl_root_path . 'include/constants_errors.php');
require_once($gl_root_path . 'include/constants_logstream.php');
// ---
class MsgParser_iis extends MsgParser {
// protected $_arrProperties = null;
// Constructor
public function MsgParser_iis() {
return; // Nothing
}
/**
* ParseLine
*
* @param arrArguments array in&out: properties of interest. There can be no guarantee the logstream can actually deliver them.
* @return integer Error stat
*/
public function ParseMsg($szMsg, &$arrArguments)
{
global $content, $fields;
// Special case here, if loglines start with #, they are comments and have to be skipped!
$iSharpPos = strpos($szMsg, "#");
if ( $iSharpPos !== false && $iSharpPos == 0 )
return ERROR_MSG_SKIPMESSAGE;
// LogFormat: date time cs-method cs-uri-stem cs-uri-query cs-username c-ip cs-version cs(User-Agent) cs(Referer) sc-status sc-bytes
// Sample: 2008-09-17 00:15:24 GET /Include/MyStyleV2.css - - 208.111.154.249 HTTP/1.0 Mozilla/5.0+(X11;+U;+Linux+i686+(x86_64);+en-US;+rv:1.8.1.11)+Gecko/20080109+(Charlotte/0.9t;+http://www.searchme.com/support/) http://www.adiscon.com/Common/en/News/MWCon-2005-09-12.php 200 1812
if ( preg_match('/([0-9]{4,4}-[0-9]{1,2}-[0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) (.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?) (.|.*?)$/', $szMsg, $out ) )
{
// print_r ( $out );
// exit;
// Set generic properties
$arrArguments[SYSLOG_DATE] = GetEventTime($out[1]);
$arrArguments[SYSLOG_HOST] = $out[6];
// Set weblog specific properties!
$arrArguments[SYSLOG_WEBLOG_METHOD] = $out[2];
// $arrArguments[SYSLOG_WEBLOG_USER] = $out[3];
if ( strpos($out[3], "?") === false )
{
$arrArguments[SYSLOG_WEBLOG_URL] = $out[3];
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= "";
}
else
{
$arrArguments[SYSLOG_WEBLOG_URL] = substr( $out[6], 0, strpos($out[3], "?"));
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= substr( $out[6], strpos($out[3], "?")+1 );
}
$arrArguments[SYSLOG_WEBLOG_PVER] = $out[7];
$arrArguments[SYSLOG_WEBLOG_USERAGENT] = $out[8];
$arrArguments[SYSLOG_WEBLOG_REFERER] = $out[9];
$arrArguments[SYSLOG_WEBLOG_STATUS] = $out[10];
$arrArguments[SYSLOG_WEBLOG_BYTESSEND] = $out[11];
// Set msg to whole logline
$arrArguments[SYSLOG_MESSAGE] = $out[0];
if ( $this->_MsgNormalize == 1 )
{
//Init tmp msg
$szTmpMsg = "";
// Create Field Array to prepend into msg! Reverse Order here
$myFields = array( SYSLOG_WEBLOG_USER, SYSLOG_WEBLOG_PVER, SYSLOG_WEBLOG_USERAGENT, SYSLOG_WEBLOG_BYTESSEND, SYSLOG_WEBLOG_STATUS, SYSLOG_WEBLOG_REFERER, SYSLOG_WEBLOG_METHOD, SYSLOG_WEBLOG_QUERYSTRING, SYSLOG_WEBLOG_URL );
foreach ( $myFields as $myField )
{
// Set Field Caption
if ( isset($content[ $fields[$myField]['FieldCaptionID'] ]) )
$szFieldName = $content[ $fields[$myField]['FieldCaptionID'] ];
else
$szFieldName = $fields[$myField]['FieldCaptionID'];
// Append Field into msg
$szTmpMsg = $szFieldName . ": '" . $arrArguments[$myField] . "'\n" . $szTmpMsg;
}
// copy finished MSG back!
$arrArguments[SYSLOG_MESSAGE] = $szTmpMsg;
}
}
else
{
// return no match in this case!
return ERROR_MSG_NOMATCH;
}
// Set IUT Property if success!
$arrArguments[SYSLOG_MESSAGETYPE] = IUT_APACHELOG;
// If we reached this position, return success!
return SUCCESS;
}
}
?>

BIN
src/images/icons/earth_find.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.0 KiB

BIN
src/images/icons/find.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 751 B

BIN
src/images/icons/find_next.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 863 B

BIN
src/images/icons/help2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 901 B

BIN
src/images/icons/help3.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 899 B

2
src/include/constants_errors.php
View File

@ -62,6 +62,6 @@ define('ERROR_DB_DBFIELDNOTFOUND', 19);
define('ERROR_MSG_NOMATCH', 18);
define('ERROR_CHARTS_NOTCONFIGURED', 20);
define('ERROR_MSG_SKIPMESSAGE', 21);
?>

18
src/include/functions_common.php
View File

@ -519,8 +519,13 @@ function InitFrontEndVariables()
$content['MENU_SELECTION_DISABLED'] = $content['BASEPATH'] . "images/icons/selection.png";
$content['MENU_SELECTION_ENABLED'] = $content['BASEPATH'] . "images/icons/selection_delete.png";
$content['MENU_TEXT_FIND'] = $content['BASEPATH'] . "images/icons/text_find.png";
$content['MENU_EARTH_FIND'] = $content['BASEPATH'] . "images/icons/earth_find.png";
$content['MENU_FIND'] = $content['BASEPATH'] . "images/icons/find.png";
$content['MENU_NEXT_FIND'] = $content['BASEPATH'] . "images/icons/find_next.png";
$content['MENU_NETWORK'] = $content['BASEPATH'] . "images/icons/earth_network.png";
$content['MENU_HELP'] = $content['BASEPATH'] . "images/icons/help.png";
$content['MENU_HELP_BLUE'] = $content['BASEPATH'] . "images/icons/help2.png";
$content['MENU_HELP_ORANGE'] = $content['BASEPATH'] . "images/icons/help3.png";
$content['MENU_KB'] = $content['BASEPATH'] . "images/icons/books.png";
$content['MENU_DOCUMENTVIEW'] = $content['BASEPATH'] . "images/icons/document_view.png";
$content['MENU_DATAEDIT'] = $content['BASEPATH'] . "images/icons/data_edit.png";
@ -1051,6 +1056,8 @@ function AddContextLinks(&$sourceTxt)
*/
function InsertLookupLink( $szIP, $szDomain, $prepend, $append )
{
global $content;
// Create string
$szReturn = $prepend;
if ( strlen($szIP) > 0 )
@ -1070,9 +1077,20 @@ function InsertLookupLink( $szIP, $szDomain, $prepend, $append )
else
// Normal LINK!
$szReturn .= '<a href="http://kb.monitorware.com/kbsearch.php?sa=whois&oid=ip&origin=phplogcon&q=' . $szIP . '" target="_top" class="contextlink">' . $szIP . '</a>';
// Add InfoSearch Link
$szReturn .= '<a href="asktheoracle.php?type=ip&query=' . $szIP . '" target="_top"><img src="' . $content['MENU_HELP_BLUE'] . '" width="16" height="16" title="' . $content['LN_GEN_MOREINFORMATION'] . '"></a>';
}
else if ( strlen($szDomain) > 0 )
{
$szReturn .= '<a href="http://kb.monitorware.com/kbsearch.php?sa=whois&oid=name&origin=phplogcon&q=' . $szDomain . '" target="_top" class="contextlink">' . $szDomain . '</a>';
// Add InfoSearch Link
$szReturn .= '<a href="asktheoracle.php?type=domain&query=' . $szDomain . '" target="_top"><img src="' . $content['MENU_HELP_BLUE'] . '" width="16" height="16" title="' . $content['LN_GEN_MOREINFORMATION'] . '"></a>';
}
// Append the append string now
$szReturn .= $append;
// return result

2
src/lang/de/main.php
View File

@ -87,6 +87,8 @@ $content['LN_ERROR_NORECORDS'] = "Es wurden keine syslog-Eintr&auml;ge gefunden.
$content['LN_GEN_ERROR_EXPORING'] = "Error exporting data";
$content['LN_GEN_ERROR_INVALIDEXPORTTYPE'] = "Invalid Export format selected, or other parameters were wrong.";
$content['LN_GEN_ERROR_SOURCENOTFOUND'] = "The Source with ID '%1' could not be found.";
$content['LN_GEN_MOREINFORMATION'] = "More Information";
// Topmenu Entries
$content['LN_MENU_SEARCH'] = "Suchen";

1
src/lang/en/main.php
View File

@ -88,6 +88,7 @@ $content['LN_ERROR_DB_DBFIELDNOTFOUND'] = "Database Field mapping for at least o
$content['LN_GEN_ERROR_EXPORING'] = "Error exporting data";
$content['LN_GEN_ERROR_INVALIDEXPORTTYPE'] = "Invalid Export format selected, or other parameters were wrong.";
$content['LN_GEN_ERROR_SOURCENOTFOUND'] = "The Source with ID '%1' could not be found.";
$content['LN_GEN_MOREINFORMATION'] = "More Information";
// Topmenu Entries
$content['LN_MENU_SEARCH'] = "Search";

1
src/lang/pt_BR/main.php
View File

@ -91,6 +91,7 @@ $content['LN_ERROR_NORECORDS'] = "Sem mensagens encontradas.";
$content['LN_GEN_ERROR_EXPORING'] = "Error exporting data";
$content['LN_GEN_ERROR_INVALIDEXPORTTYPE'] = "Invalid Export format selected, or other parameters were wrong.";
$content['LN_GEN_ERROR_SOURCENOTFOUND'] = "The Source with ID '%1' could not be found.";
$content['LN_GEN_MOREINFORMATION'] = "More Information";
// Topmenu Entries