tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-25 10:57:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

testings

Browse Source
This commit is contained in:
Andre Lorbach 2012-05-04 09:42:52 +02:00
parent 31a67dd510
commit 5b00de462e
2 changed files with 1 additions and 242 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/classes/logstream.class.php
View File

@ -436,7 +436,7 @@ abstract class LogStream {
if (
array_key_exists($propertyname, $this->_filters) &&
isset($propertyvalue) /* &&
!(is_string($propertyvalue) && strlen($propertyvalue) <= 0) /* Negative because it only matters if the propvalure is a string*/
!(is_string($propertyvalue) && strlen($propertyvalue) <= 0)*/ /*Negative because it only matters if the propvalure is a string*/
)
{
@ -560,7 +560,6 @@ abstract class LogStream {
case FILTER_TYPE_DATE:
// Get Log TimeStamp
$nLogTimeStamp = $arrProperitesOut[$propertyname][EVTIME_TIMESTAMP];
if ( $myfilter[FILTER_DATEMODE] == DATEMODE_LASTX )
{
// Get current timestamp

240
src/classes/logstreammongodb.class.php
View File

@ -1505,246 +1505,6 @@ class LogStreamMongoDB extends LogStream {
return SUCCESS;
}
/*
* This function expects the filters to already being set earlier.
* Otherwise no usual WHERE Clause can be created!
*/
private function CreateSQLWhereClause()
{
// DEBUG FOF NOW
return SUCCESS;
if ( $this->_filters != null )
{
global $dbmapping;
$szTableType = $this->_logStreamConfigObj->DBTableType;
// Reset WhereClause
$this->_SQLwhereClause = "";
// --- Build Query Array
$arrayQueryProperties = $this->_arrProperties;
if ( isset($this->_arrFilterProperties) && $this->_arrFilterProperties != null)
{
foreach ( $this->_arrFilterProperties as $filterproperty )
{
if ( $this->_arrProperties == null || !in_array($filterproperty, $this->_arrProperties) )
$arrayQueryProperties[] = $filterproperty;
}
}
// ---
// Loop through all available properties
foreach( $arrayQueryProperties as $propertyname )
{
// If the property exists in the filter array, we have something to filter for ^^!
if ( array_key_exists($propertyname, $this->_filters) )
{
// Process all filters
foreach( $this->_filters[$propertyname] as $myfilter )
{
// Only perform if database mapping is available for this filter!
if ( isset($dbmapping[$szTableType]['DBMAPPINGS'][$propertyname]) )
{
switch( $myfilter[FILTER_TYPE] )
{
case FILTER_TYPE_STRING:
// --- Either make a LIKE or a equal query!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
{
// Set addnot to nothing
$addnod = "";
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
{
$szSearchBegin = " = '";
$szSearchEnd = "' ";
}
else
{
$szSearchBegin = " <> '";
$szSearchEnd = "' ";
}
// ---
}
else if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHREGEX )
{
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
$addnod = "";
else
$addnod = " NOT";
// ---
$szSearchBegin = " REGEXP '";
$szSearchEnd = "' ";
}
else
{
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
$addnod = "";
else
$addnod = " NOT";
// ---
$szSearchBegin = " LIKE '%";
$szSearchEnd = "%' ";
}
// ---
// --- If Syslog message, we have AND handling, otherwise OR!
if ( $propertyname == SYSLOG_MESSAGE )
$addor = " AND ";
else
{
// If we exclude filters, we need to combine with AND
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
$addor = " OR ";
else
$addor = " AND ";
}
// ---
// Now Create LIKE Filters
if ( isset($tmpfilters[$propertyname]) )
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . $addnod . $szSearchBegin . DB_RemoveBadChars($myfilter[FILTER_VALUE]) . $szSearchEnd;
else
{
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_STRING;
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . $addnod . $szSearchBegin . DB_RemoveBadChars($myfilter[FILTER_VALUE]) . $szSearchEnd;
}
break;
case FILTER_TYPE_NUMBER:
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_EXCLUDE )
{
// Add to filterset
$szArrayKey = $propertyname . "-NOT";
if ( isset($tmpfilters[$szArrayKey]) )
$tmpfilters[$szArrayKey][FILTER_VALUE] .= ", " . $myfilter[FILTER_VALUE];
else
{
$tmpfilters[$szArrayKey][FILTER_TYPE] = FILTER_TYPE_NUMBER;
$tmpfilters[$szArrayKey][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " NOT IN (" . DB_RemoveBadChars($myfilter[FILTER_VALUE]);
}
}
else
{
// Add to filterset
if ( isset($tmpfilters[$propertyname]) )
$tmpfilters[$propertyname][FILTER_VALUE] .= ", " . $myfilter[FILTER_VALUE];
else
{
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_NUMBER;
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " IN (" . DB_RemoveBadChars($myfilter[FILTER_VALUE]);
}
}
// ---
break;
case FILTER_TYPE_DATE:
if ( isset($tmpfilters[$propertyname]) )
$tmpfilters[$propertyname][FILTER_VALUE] .= " AND ";
else
{
$tmpfilters[$propertyname][FILTER_VALUE] = "";
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_DATE;
}
if ( $myfilter[FILTER_DATEMODE] == DATEMODE_LASTX )
{
// Get current timestamp
$nNowTimeStamp = time();
if ( $myfilter[FILTER_VALUE] == DATE_LASTX_HOUR )
$nNowTimeStamp -= 60 * 60; // One Hour!
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_12HOURS )
$nNowTimeStamp -= 60 * 60 * 12; // 12 Hours!
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_24HOURS )
$nNowTimeStamp -= 60 * 60 * 24; // 24 Hours!
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_7DAYS )
$nNowTimeStamp -= 60 * 60 * 24 * 7; // 7 days
else if ( $myfilter[FILTER_VALUE] == DATE_LASTX_31DAYS )
$nNowTimeStamp -= 60 * 60 * 24 * 31; // 31 days
else
{
// Set filter to unknown and Abort in this case!
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_UNKNOWN;
break;
}
// Append filter
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " > '" . date("Y-m-d H:i:s", $nNowTimeStamp) . "'";
}
else if ( $myfilter[FILTER_DATEMODE] == DATEMODE_RANGE_FROM )
{
// Obtain Event struct for the time!
$myeventtime = GetEventTime($myfilter[FILTER_VALUE]);
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " > '" . date("Y-m-d H:i:s", $myeventtime[EVTIME_TIMESTAMP]) . "'";
}
else if ( $myfilter[FILTER_DATEMODE] == DATEMODE_RANGE_TO )
{
// Obtain Event struct for the time!
$myeventtime = GetEventTime($myfilter[FILTER_VALUE]);
$tmpfilters[$propertyname][FILTER_VALUE] .= $dbmapping[$szTableType]['DBMAPPINGS'][$propertyname] . " < '" . date("Y-m-d H:i:s", $myeventtime[EVTIME_TIMESTAMP]) . "'";
}
break;
default:
// Nothing to do!
break;
}
}
else
{
// Check how to treat not found db mappings / filters
if ( GetConfigSetting("TreatNotFoundFiltersAsTrue", 0, CFGLEVEL_USER) == 0 )
return ERROR_DB_DBFIELDNOTFOUND;
}
}
}
}
// Check and combine all filters now!
if ( isset($tmpfilters) )
{
// Append filters
foreach( $tmpfilters as $tmpfilter )
{
// Init WHERE or Append AND
if ( strlen($this->_SQLwhereClause) > 0 )
$this->_SQLwhereClause .= " AND ";
else
$this->_SQLwhereClause = " WHERE ";
switch( $tmpfilter[FILTER_TYPE] )
{
case FILTER_TYPE_STRING:
$this->_SQLwhereClause .= "( " . $tmpfilter[FILTER_VALUE] . ") ";
break;
case FILTER_TYPE_NUMBER:
$this->_SQLwhereClause .= $tmpfilter[FILTER_VALUE] . ") ";
break;
case FILTER_TYPE_DATE:
$this->_SQLwhereClause .= $tmpfilter[FILTER_VALUE];
break;
default:
// Should not happen, wrong filters!
// We add a dummy into the where clause, just as a place holder
$this->_SQLwhereClause .= " 1=1 ";
break;
}
}
}
// echo $this->_SQLwhereClause;
//$dbmapping[$szTableType][SYSLOG_UID]
}
else // No filters means nothing to do!
return SUCCESS;
}
/*
* This helper function will read the next records into the buffer.
*/