tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-26 11:19:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added parser for apache2 common format.

Browse Source 
Parser remove spaces from begin and end now, before parsing the msg
This commit is contained in:
Andre Lorbach 2008-10-07 11:19:16 +02:00
parent e0a4fd6b99
commit d30e06e6bd
4 changed files with 163 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/classes/msgparsers/msgparser.apache2.class.php
View File

@ -3,8 +3,10 @@
*********************************************************************
* -> www.phplogcon.org <- *
* ----------------------------------------------------------------- *
* Apache Logfile Parser used to split WebLog fields if found
* in the msg
* Apache Logfile Parser used to split WebLog fields if
* found in the msg.
*
* This Parser is for the default apache "combined" format!
* *
* All directives are explained within this file *
*
@ -63,6 +65,9 @@ class MsgParser_apache2 extends MsgParser {
{
global $content, $fields;
//trim the msg first to remove spaces from begin and end
$szMsg = trim($szMsg);
//return ERROR_MSG_NOMATCH;
// LogFormat "%h %l %u %t \"%r\" %>s %b" common
@ -95,7 +100,7 @@ class MsgParser_apache2 extends MsgParser {
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= substr( $out[6], strpos($out[6], "?")+1 );
}
// $arrArguments[SYSLOG_WEBLOG_QUERYSTRING] = $out[7];
// Number based fields
$arrArguments[SYSLOG_WEBLOG_PVER] = $out[7];
$arrArguments[SYSLOG_WEBLOG_STATUS] = $out[8];
$arrArguments[SYSLOG_WEBLOG_BYTESSEND] = $out[9];

149
src/classes/msgparsers/msgparser.apache2common.class.php Normal file
View File

@ -0,0 +1,149 @@
<?php
/*
*********************************************************************
* -> www.phplogcon.org <- *
* ----------------------------------------------------------------- *
* Apache Logfile Parser used to split WebLog fields if
* found in the msg.
*
* This Parser is for the default apache "common" format!
* *
* All directives are explained within this file *
*
* Copyright (C) 2008 Adiscon GmbH.
*
* This file is part of phpLogCon.
*
* PhpLogCon is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* PhpLogCon is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with phpLogCon. If not, see <http://www.gnu.org/licenses/>.
*
* A copy of the GPL can be found in the file "COPYING" in this
* distribution.
*********************************************************************
*/
// --- Avoid directly accessing this file!
if ( !defined('IN_PHPLOGCON') )
{
die('Hacking attempt');
exit;
}
// ---
// --- Basic Includes
require_once($gl_root_path . 'classes/enums.class.php');
require_once($gl_root_path . 'classes/msgparser.class.php');
require_once($gl_root_path . 'include/constants_errors.php');
require_once($gl_root_path . 'include/constants_logstream.php');
// ---
class MsgParser_apache2common extends MsgParser {
// protected $_arrProperties = null;
// Constructor
public function MsgParser_apache2common() {
return; // Nothing
}
/**
* ParseLine
*
* @param arrArguments array in&out: properties of interest. There can be no guarantee the logstream can actually deliver them.
* @return integer Error stat
*/
public function ParseMsg($szMsg, &$arrArguments)
{
global $content, $fields;
//trim the msg first to remove spaces from begin and end
$szMsg = trim($szMsg);
//return ERROR_MSG_NOMATCH;
// LogFormat "%h %l %u %t \"%r\" %>s %b" common
// LogFormat "%{Referer}i -> %U" referer
// LogFormat "%{User-agent}i" agent
// LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
// Sample (apache2): 127.0.0.1 - - [14/Sep/2008:06:50:15 +0200] "GET / HTTP/1.0" 200 19023
// Sample: 65.55.211.112 - - [16/Sep/2008:13:37:47 +0200] "GET /index.php?name=News&file=article&sid=1&theme=Printer HTTP/1.1" 200 4908
if ( preg_match('/(.|.*?) (.|.*?) (.|.*?) \[(.*?)\] "(.*?) (.*?) (.*?)" (.|[0-9]{1,12}) (.|[0-9]{1,12})$/', $szMsg, $out ) )
{
// print_r ( $out );
// exit;
// Set generic properties
$arrArguments[SYSLOG_HOST] = $out[1];
$arrArguments[SYSLOG_DATE] = GetEventTime($out[4]);
// Set weblog specific properties!
$arrArguments[SYSLOG_WEBLOG_USER] = $out[3];
$arrArguments[SYSLOG_WEBLOG_METHOD] = $out[5];
if ( strpos($out[6], "?") === false )
{
$arrArguments[SYSLOG_WEBLOG_URL] = $out[6];
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= "";
}
else
{
$arrArguments[SYSLOG_WEBLOG_URL] = substr( $out[6], 0, strpos($out[6], "?"));
$arrArguments[SYSLOG_WEBLOG_QUERYSTRING]= substr( $out[6], strpos($out[6], "?")+1 );
}
// Number based fields
$arrArguments[SYSLOG_WEBLOG_PVER] = $out[7];
$arrArguments[SYSLOG_WEBLOG_STATUS] = $out[8];
$arrArguments[SYSLOG_WEBLOG_BYTESSEND] = $out[9];
// Set msg to whole logline
$arrArguments[SYSLOG_MESSAGE] = $out[0];
if ( $this->_MsgNormalize == 1 )
{
//Init tmp msg
$szTmpMsg = "";
// Create Field Array to prepend into msg! Reverse Order here
$myFields = array( SYSLOG_WEBLOG_USER, SYSLOG_WEBLOG_PVER, SYSLOG_WEBLOG_BYTESSEND, SYSLOG_WEBLOG_STATUS, SYSLOG_WEBLOG_METHOD, SYSLOG_WEBLOG_QUERYSTRING, SYSLOG_WEBLOG_URL );
foreach ( $myFields as $myField )
{
// Set Field Caption
if ( isset($content[ $fields[$myField]['FieldCaptionID'] ]) )
$szFieldName = $content[ $fields[$myField]['FieldCaptionID'] ];
else
$szFieldName = $fields[$myField]['FieldCaptionID'];
// Append Field into msg
$szTmpMsg = $szFieldName . ": '" . $arrArguments[$myField] . "'\n" . $szTmpMsg;
}
// copy finished MSG back!
$arrArguments[SYSLOG_MESSAGE] = $szTmpMsg;
}
}
else
{
// return no match in this case!
return ERROR_MSG_NOMATCH;
}
// Set IUT Property if success!
$arrArguments[SYSLOG_MESSAGETYPE] = IUT_WEBSERVERLOG;
// If we reached this position, return success!
return SUCCESS;
}
}
?>

3
src/classes/msgparsers/msgparser.eventlog.class.php
View File

@ -63,6 +63,9 @@ class MsgParser_eventlog extends MsgParser {
{
global $content, $fields;
//trim the msg first to remove spaces from begin and end
$szMsg = trim($szMsg);
// Sample (WinSyslog/EventReporter): 7035,XPVS2005\Administrator,Service Control Manager,System,[INF],0,The Adiscon EvntSLog service was successfully sent a start control.
// Source: %id%,%user%,%sourceproc%,%NTEventLogType%,%severity%,%category%,%msg%%$CRLF%
if ( preg_match("/([0-9]{1,12}),(.*?),(.*?),(.*?),(.*?),([0-9]{1,12}),(.*?)$/", $szMsg, $out ) )

3
src/classes/msgparsers/msgparser.iis.class.php
View File

@ -62,6 +62,9 @@ class MsgParser_iis extends MsgParser {
public function ParseMsg($szMsg, &$arrArguments)
{
global $content, $fields;
//trim the msg first to remove spaces from begin and end
$szMsg = trim($szMsg);
// $iSharpPos = strpos($szMsg, "#");
// if ( $iSharpPos !== false && $iSharpPos == 0 )