mirror of
https://github.com/rsyslog/loganalyzer.git
synced 2025-09-25 18:59:12 +02:00
testings
This commit is contained in:
Andre Lorbach
parent
31a67dd510
commit
5b00de462e
@ -436,7 +436,7 @@ abstract class LogStream {
|
|||||||
if (
|
if (
|
||||||
array_key_exists($propertyname, $this->_filters) &&
|
array_key_exists($propertyname, $this->_filters) &&
|
||||||
isset($propertyvalue) /* &&
|
isset($propertyvalue) /* &&
|
||||||
!(is_string($propertyvalue) && strlen($propertyvalue) <= 0) /* Negative because it only matters if the propvalure is a string*/
|
!(is_string($propertyvalue) && strlen($propertyvalue) <= 0)*/ /*Negative because it only matters if the propvalure is a string*/
|
||||||
)
|
)
|
||||||
{
|
{
|
||||||
|
|
||||||
@ -560,7 +560,6 @@ abstract class LogStream {
|
|||||||
case FILTER_TYPE_DATE:
|
case FILTER_TYPE_DATE:
|
||||||
// Get Log TimeStamp
|
// Get Log TimeStamp
|
||||||
$nLogTimeStamp = $arrProperitesOut[$propertyname][EVTIME_TIMESTAMP];
|
$nLogTimeStamp = $arrProperitesOut[$propertyname][EVTIME_TIMESTAMP];
|
||||||
|
|
||||||
if ( $myfilter[FILTER_DATEMODE] == DATEMODE_LASTX )
|
if ( $myfilter[FILTER_DATEMODE] == DATEMODE_LASTX )
|
||||||
{
|
{
|
||||||
// Get current timestamp
|
// Get current timestamp
|
||||||
|
|||||||
@ -1505,246 +1505,6 @@ class LogStreamMongoDB extends LogStream {
|
|||||||
return SUCCESS;
|
return SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
|
||||||
* This function expects the filters to already being set earlier.
|
|
||||||
* Otherwise no usual WHERE Clause can be created!
|
|
||||||
*/
|
|
||||||
private function CreateSQLWhereClause()
|
|
||||||
{
|
|
||||||
// DEBUG FOF NOW
|
|
||||||
return SUCCESS;
|
|
||||||
|
|
||||||
if ( $this->_filters != null )
|
|
||||||
{
|
|
||||||
global $dbmapping;
|
|
||||||
$szTableType = $this->_logStreamConfigObj->DBTableType;
|
|
||||||
|
|
||||||
// Reset WhereClause
|
|
||||||
$this->_SQLwhereClause = "";
|
|
||||||
|
|
||||||
// --- Build Query Array
|
|
||||||
$arrayQueryProperties = $this->_arrProperties;
|
|
||||||
if ( isset($this->_arrFilterProperties) && $this->_arrFilterProperties != null)
|
|
||||||
{
|
|
||||||
foreach ( $this->_arrFilterProperties as $filterproperty )
|
|
||||||
{
|
|
||||||
if ( $this->_arrProperties == null || !in_array($filterproperty, $this->_arrProperties) )
|
|
||||||
$arrayQueryProperties[] = $filterproperty;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// ---
|
|
||||||
|
|
||||||
// Loop through all available properties
|
|
||||||
foreach( $arrayQueryProperties as $propertyname )
|
|
||||||
{
|
|
||||||
// If the property exists in the filter array, we have something to filter for ^^!
|
|
||||||
if ( array_key_exists($propertyname, $this->_filters) )
|
|
||||||
{
|
|
||||||
// Process all filters
|
|
||||||
foreach( $this->_filters[$propertyname] as $myfilter )
|
|
||||||
{
|
|
||||||
// Only perform if database mapping is available for this filter!
|
|
||||||
if ( isset($dbmapping[$szTableType]['DBMAPPINGS'][$propertyname]) )
|
|
||||||
{
|
|
||||||
switch( $myfilter[FILTER_TYPE] )
|
|
||||||
{
|
|
||||||
case FILTER_TYPE_STRING:
|
|
||||||
// --- Either make a LIKE or a equal query!
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
|
|
||||||
{
|
|
||||||
// Set addnot to nothing
|
|
||||||
$addnod = "";
|
|
||||||
|
|
||||||
// --- Check if user wants to include or exclude!
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
|
|
||||||
{
|
|
||||||
$szSearchBegin = " = '";
|
|
||||||
$szSearchEnd = "' ";
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$szSearchBegin = " <> '";
|
|
||||||
$szSearchEnd = "' ";
|
|
||||||
}
|
|
||||||
// ---
|
|
||||||
}
|
|
||||||
else if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHREGEX )
|
|
||||||
{
|
|
||||||
// --- Check if user wants to include or exclude!
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
|
|
||||||
$addnod = "";
|
|
||||||
else
|
|
||||||
$addnod = " NOT";
|
|
||||||
// ---
|
|
||||||
|
|
||||||
$szSearchBegin = " REGEXP '";
|
|
||||||
$szSearchEnd = "' ";
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// --- Check if user wants to include or exclude!
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
|
|
||||||
$addnod = "";
|
|
||||||
else
|
|
||||||
$addnod = " NOT";
|
|
||||||
// ---
|
|
||||||
|
|
||||||
$szSearchBegin = " LIKE '%";
|
|
||||||
$szSearchEnd = "%' ";
|
|
||||||
}
|
|
||||||
// ---
|
|
||||||
|
|
||||||
// --- If Syslog message, we have AND handling, otherwise OR!
|
|
||||||
if ( $propertyname == SYSLOG_MESSAGE )
|
|
||||||
$addor = " AND ";
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// If we exclude filters, we need to combine with AND
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
|
|
||||||
$addor = " OR ";
|
|
||||||
else
|
|
||||||
$addor = " AND ";
|
|
||||||
}
|
|
||||||
// ---
|
|
||||||
|
|
||||||
// Now Create LIKE Filters
|
|
||||||
if ( isset($tmpfilters[$propertyname]) )
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . $addnod . $szSearchBegin . DB_RemoveBadChars($myfilter[FILTER_VALUE]) . $szSearchEnd;
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_STRING;
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . $addnod . $szSearchBegin . DB_RemoveBadChars($myfilter[FILTER_VALUE]) . $szSearchEnd;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
case FILTER_TYPE_NUMBER:
|
|
||||||
// --- Check if user wants to include or exclude!
|
|
||||||
if ( $myfilter[FILTER_MODE] & FILTER_MODE_EXCLUDE )
|
|
||||||
{
|
|
||||||
// Add to filterset
|
|
||||||
$szArrayKey = $propertyname . "-NOT";
|
|
||||||
if ( isset($tmpfilters[$szArrayKey]) )
|
|
||||||
$tmpfilters[$szArrayKey][FILTER_VALUE] .= ", " . $myfilter[FILTER_VALUE];
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$tmpfilters[$szArrayKey][FILTER_TYPE] = FILTER_TYPE_NUMBER;
|
|
||||||
$tmpfilters[$szArrayKey][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " NOT IN (" . DB_RemoveBadChars($myfilter[FILTER_VALUE]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// Add to filterset
|
|
||||||
if ( isset($tmpfilters[$propertyname]) )
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= ", " . $myfilter[FILTER_VALUE];
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_NUMBER;
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " IN (" . DB_RemoveBadChars($myfilter[FILTER_VALUE]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// ---
|
|
||||||
break;
|
|
||||||
case FILTER_TYPE_DATE:
|
|
||||||
if ( isset($tmpfilters[$propertyname]) )
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= " AND ";
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] = "";
|
|
||||||
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_DATE;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $myfilter[FILTER_DATEMODE] == DATEMODE_LASTX )
|
|
||||||
{
|
|
||||||
// Get current timestamp
|
|
||||||
$nNowTimeStamp = time();
|
|
||||||
|
|
||||||
if ( $myfilter[FILTER_VALUE] == DATE_LASTX_HOUR )
|
|
||||||
$nNowTimeStamp -= 60 * 60; // One Hour!
|
|
||||||
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_12HOURS )
|
|
||||||
$nNowTimeStamp -= 60 * 60 * 12; // 12 Hours!
|
|
||||||
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_24HOURS )
|
|
||||||
$nNowTimeStamp -= 60 * 60 * 24; // 24 Hours!
|
|
||||||
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_7DAYS )
|
|
||||||
$nNowTimeStamp -= 60 * 60 * 24 * 7; // 7 days
|
|
||||||
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_31DAYS )
|
|
||||||
$nNowTimeStamp -= 60 * 60 * 24 * 31; // 31 days
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// Set filter to unknown and Abort in this case!
|
|
||||||
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_UNKNOWN;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Append filter
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " > '" . date("Y-m-d H:i:s", $nNowTimeStamp) . "'";
|
|
||||||
}
|
|
||||||
else if ( $myfilter[FILTER_DATEMODE] == DATEMODE_RANGE_FROM )
|
|
||||||
{
|
|
||||||
// Obtain Event struct for the time!
|
|
||||||
$myeventtime = GetEventTime($myfilter[FILTER_VALUE]);
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " > '" . date("Y-m-d H:i:s", $myeventtime[EVTIME_TIMESTAMP]) . "'";
|
|
||||||
}
|
|
||||||
else if ( $myfilter[FILTER_DATEMODE] == DATEMODE_RANGE_TO )
|
|
||||||
{
|
|
||||||
// Obtain Event struct for the time!
|
|
||||||
$myeventtime = GetEventTime($myfilter[FILTER_VALUE]);
|
|
||||||
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " < '" . date("Y-m-d H:i:s", $myeventtime[EVTIME_TIMESTAMP]) . "'";
|
|
||||||
}
|
|
||||||
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
// Nothing to do!
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// Check how to treat not found db mappings / filters
|
|
||||||
if ( GetConfigSetting("TreatNotFoundFiltersAsTrue", 0, CFGLEVEL_USER) == 0 )
|
|
||||||
return ERROR_DB_DBFIELDNOTFOUND;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check and combine all filters now!
|
|
||||||
if ( isset($tmpfilters) )
|
|
||||||
{
|
|
||||||
// Append filters
|
|
||||||
foreach( $tmpfilters as $tmpfilter )
|
|
||||||
{
|
|
||||||
// Init WHERE or Append AND
|
|
||||||
if ( strlen($this->_SQLwhereClause) > 0 )
|
|
||||||
$this->_SQLwhereClause .= " AND ";
|
|
||||||
else
|
|
||||||
$this->_SQLwhereClause = " WHERE ";
|
|
||||||
|
|
||||||
switch( $tmpfilter[FILTER_TYPE] )
|
|
||||||
{
|
|
||||||
case FILTER_TYPE_STRING:
|
|
||||||
$this->_SQLwhereClause .= "( " . $tmpfilter[FILTER_VALUE] . ") ";
|
|
||||||
break;
|
|
||||||
case FILTER_TYPE_NUMBER:
|
|
||||||
$this->_SQLwhereClause .= $tmpfilter[FILTER_VALUE] . ") ";
|
|
||||||
break;
|
|
||||||
case FILTER_TYPE_DATE:
|
|
||||||
$this->_SQLwhereClause .= $tmpfilter[FILTER_VALUE];
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
// Should not happen, wrong filters!
|
|
||||||
// We add a dummy into the where clause, just as a place holder
|
|
||||||
$this->_SQLwhereClause .= " 1=1 ";
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// echo $this->_SQLwhereClause;
|
|
||||||
//$dbmapping[$szTableType][SYSLOG_UID]
|
|
||||||
}
|
|
||||||
else // No filters means nothing to do!
|
|
||||||
return SUCCESS;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* This helper function will read the next records into the buffer.
|
* This helper function will read the next records into the buffer.
|
||||||
*/
|
*/
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user