tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-25 18:59:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Implemented method to update all checksum values at once in logstream classes

Browse Source 
Enhanced Syslog logging, if socket functions are available, RFC5424 Syslog messages are generated for
better debugging support.
This commit is contained in:
Andre Lorbach 2011-10-27 12:34:05 +02:00
parent d165136827
commit ea7db9a839
6 changed files with 226 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/classes/logstream.class.php
View File

@ -252,6 +252,12 @@ abstract class LogStream {
public abstract function SaveMessageChecksum( $arrProperitesIn );
/*
* Helper function to set the checksum for all messages in the current logstream class
*/
public abstract function UpdateAllMessageChecksum( );
/*
* Helper function for logstream classes to clear filter based stuff
*/
@ -279,7 +285,7 @@ abstract class LogStream {
else
$finalfilters = $szFilters;
OutputDebugMessage("SetFilter combined = '" . $finalfilters . "'. ", DEBUG_DEBUG);
OutputDebugMessage("LogStream|SetFilter: SetFilter combined = '" . $finalfilters . "'. ", DEBUG_DEBUG);
// Reset Filters first to make sure we do not add multiple filters!
$this->_filters = null;

47
src/classes/logstreamdb.class.php
View File

@ -601,6 +601,46 @@ class LogStreamDB extends LogStream {
return $rowcount;
}
/*
* Implementation of the UpdateAllMessageChecksum
*
* Update all missing checksum properties in the current database
*/
public function UpdateAllMessageChecksum( )
{
global $querycount, $dbmapping;
$szTableType = $this->_logStreamConfigObj->DBTableType;
// UPDATE DATA NOW!
$szSql = "UPDATE " . $this->_logStreamConfigObj->DBTableName .
" SET " . $dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM] . " = crc32(" . $dbmapping[$szTableType]['DBMAPPINGS'][SYSLOG_MESSAGE] . ") " .
" WHERE " . $dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM] . " IS NULL";
// Output Debug Informations
OutputDebugMessage("LogStreamDB|UpdateAllMessageChecksum: Running Created SQL Query:<br>" . $szSql, DEBUG_ULTRADEBUG);
// Running SQL Query
$myQuery = mysql_query($szSql, $this->_dbhandle);
if ($myQuery)
{
// Debug Output
OutputDebugMessage("LogStreamDB|UpdateAllMessageChecksum: Successfully updated Checksum of '" . mysql_affected_rows($this->_dbhandle) . "' datarecords", DEBUG_INFO);
// Return success
return SUCCESS;
}
else
{
// error occured, output DEBUG message
$this->PrintDebugError("SaveMessageChecksum failed with SQL Statement ' " . $szSql . " '");
// Failed
return ERROR;
}
}
/*
* Implementation of the SaveMessageChecksum
*
@ -613,7 +653,7 @@ class LogStreamDB extends LogStream {
if ( isset($arrProperitesIn[SYSLOG_UID]) && isset($arrProperitesIn[MISC_CHECKSUM]) && isset($dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM]) )
{
// DELETE DATA NOW!
// UPDATE DATA NOW!
$szSql = "UPDATE " . $this->_logStreamConfigObj->DBTableName .
" SET " . $dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM] . " = " . $arrProperitesIn[MISC_CHECKSUM] .
" WHERE " . $dbmapping[$szTableType]['DBMAPPINGS'][SYSLOG_UID] . " = " . $arrProperitesIn[SYSLOG_UID];
@ -712,6 +752,9 @@ class LogStreamDB extends LogStream {
" ORDER BY " . $myDBSortedFieldName . " " . $szSortingOrder .
$szLimitSql ;
// Output Debug Informations
OutputDebugMessage("LogStreamDB|ConsolidateItemListByField: Running Created SQL Query:<br>" . $szSql, DEBUG_ULTRADEBUG);
// Perform Database Query
$myquery = mysql_query($szSql, $this->_dbhandle);
if ( !$myquery )
@ -849,7 +892,7 @@ class LogStreamDB extends LogStream {
$szLimitSql ;
// Output Debug Informations
OutputDebugMessage("LogStreamDB|ConsolidateDataByField: Running Created SQL Query:<br>" . $szSql, DEBUG_DEBUG);
OutputDebugMessage("LogStreamDB|ConsolidateDataByField: Running Created SQL Query:<br>" . $szSql, DEBUG_ULTRADEBUG);
// Perform Database Query
$myquery = mysql_query($szSql, $this->_dbhandle);

16
src/classes/logstreamdisk.class.php
View File

@ -666,6 +666,17 @@ class LogStreamDisk extends LogStream {
}
/*
* Implementation of the UpdateAllMessageChecksum
*
* not implemented!
*/
public function UpdateAllMessageChecksum( )
{
return SUCCESS;
}
/**
* Implementation of ConsolidateItemListByField
*
@ -785,6 +796,11 @@ class LogStreamDisk extends LogStream {
{
if ( isset($logArray[$szConsFieldId]) )
{
// --- Special Case for the checksum field, we need to generate the checksum ourself!
if ( $szConsFieldId == MISC_CHECKSUM )
$logArray[$szConsFieldId] = crc32( $logArray[SYSLOG_MESSAGE] );
// ---
if ( $nConsFieldType == FILTER_TYPE_DATE )
{
// Convert to FULL Day Date for now!

42
src/classes/logstreampdo.class.php
View File

@ -690,6 +690,48 @@ class LogStreamPDO extends LogStream {
}
/*
* Implementation of the UpdateAllMessageChecksum
*
* Update all missing checksum properties in the current database
*/
public function UpdateAllMessageChecksum( )
{
global $querycount, $dbmapping;
$szTableType = $this->_logStreamConfigObj->DBTableType;
// UPDATE DATA NOW!
$szSql = "UPDATE " . $this->_logStreamConfigObj->DBTableName .
" SET " . $dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM] . " = crc32(" . $dbmapping[$szTableType]['DBMAPPINGS'][SYSLOG_MESSAGE] . ") " .
" WHERE " . $dbmapping[$szTableType]['DBMAPPINGS'][MISC_CHECKSUM] . " IS NULL";
// Output Debug Informations
OutputDebugMessage("LogStreamPDO|UpdateAllMessageChecksum: Running Created SQL Query:<br>" . $szSql, DEBUG_ULTRADEBUG);
// Running SQL Query
$myQuery = $this->_dbhandle->query($szSql);
if ( $myQuery )
{
// Output Debug Informations
OutputDebugMessage("LogStreamPDO|UpdateAllMessageChecksum: Successfully updated Checksum of '" . $myQuery->rowCount() . "' datarecords", DEBUG_INFO);
// Free query now
$myQuery->closeCursor();
// Return success
return SUCCESS;
}
else
{
// error occured, output DEBUG message
$this->PrintDebugError("UpdateAllMessageChecksum failed with SQL Statement ' " . $szSql . " '");
// Failed
return ERROR;
}
}
/*
* Implementation of the SaveMessageChecksum
*

175
src/classes/reports/report.syslog.syslogsummary.class.php
View File

@ -299,13 +299,18 @@ class Report_syslogsummary extends Report {
$res = $this->_streamObj->Open( $this->_arrProperties, true );
if ( $res == SUCCESS )
{
if ( true )
{
// --- New Method to consolidate data!
// TimeStats
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
// Update all Checksums first!
$this->_streamObj->UpdateAllMessageChecksum();
// TimeStats
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
foreach ( $arrHosts as $myHost )
{
// Set custom filters
@ -333,97 +338,95 @@ class Report_syslogsummary extends Report {
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
// ---
}
else
/*
// --- Old Method!
// Init uid helper
$uID = UID_UNKNOWN;
// Set position to BEGIN of FILE
$this->_streamObj->Sseek($uID, EnumSeek::BOS, 0);
// Start reading data
$ret = $this->_streamObj->Read($uID, $logArray);
// TimeStats
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
// Found first data record
if ( $ret == SUCCESS )
{
// --- Old Method!
// Init uid helper
$uID = UID_UNKNOWN;
do
{
// Check if Event from host is in our hosts array
if ( in_array($logArray[SYSLOG_HOST], $arrHosts) )
{
// Set Host Item Basics if not set yet
if ( !isset($content["report_consdata"][ $logArray[SYSLOG_HOST] ][SYSLOG_HOST]) )
{
$content["report_consdata"][ $logArray[SYSLOG_HOST] ][SYSLOG_HOST] = $logArray[SYSLOG_HOST];
}
// Set position to BEGIN of FILE
$this->_streamObj->Sseek($uID, EnumSeek::BOS, 0);
// Calc checksum
if ( !isset($logArray[MISC_CHECKSUM]) || $logArray[MISC_CHECKSUM] == 0 )
{
// Calc crc32 from message, we use this as index
$logArray[MISC_CHECKSUM] = crc32( $logArray[SYSLOG_MESSAGE] ); // Maybe useful somewhere else: sprintf( "%u", crc32 ( $logArray[SYSLOG_MESSAGE] ));
$strChecksum = $logArray[MISC_CHECKSUM];
// Save calculated Checksum into DB!
$this->_streamObj->SaveMessageChecksum($logArray);
}
else // Get checksum
$strChecksum = $logArray[MISC_CHECKSUM];
// Check if entry exists in result array
if ( isset($content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]) )
{
// Increment counter and set First/Last Event date
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['ItemCount']++;
// Set FirstEvent date if necessary!
if ( $logArray[SYSLOG_DATE][EVTIME_TIMESTAMP] < $content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'][EVTIME_TIMESTAMP] )
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'] = $logArray[SYSLOG_DATE];
// Set LastEvent date if necessary!
if ( $logArray[SYSLOG_DATE][EVTIME_TIMESTAMP] > $content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'][EVTIME_TIMESTAMP] )
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'] = $logArray[SYSLOG_DATE];
}
else
{
// Set Basic data entries
if (isset( $content['filter_facility_list'][$logArray[SYSLOG_FACILITY]] ))
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_FACILITY] = $logArray[SYSLOG_FACILITY];
else
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_FACILITY] = SYSLOG_LOCAL0; // Set default in this case
if (isset( $content['filter_severity_list'][$logArray[SYSLOG_SEVERITY]] ))
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SEVERITY] = $logArray[SYSLOG_SEVERITY];
else
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SEVERITY] = SYSLOG_NOTICE; // Set default in this case
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SYSLOGTAG] = $logArray[SYSLOG_SYSLOGTAG];
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_MESSAGE] = $logArray[SYSLOG_MESSAGE];
// Set Counter and First/Last Event date
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['ItemCount'] = 1;
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'] = $logArray[SYSLOG_DATE];
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'] = $logArray[SYSLOG_DATE];
}
}
// Get next data record
$ret = $this->_streamObj->ReadNext($uID, $logArray);
} while ( $ret == SUCCESS );
// Start reading data
$ret = $this->_streamObj->Read($uID, $logArray);
// TimeStats
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
// Found first data record
if ( $ret == SUCCESS )
{
do
{
// Check if Event from host is in our hosts array
if ( in_array($logArray[SYSLOG_HOST], $arrHosts) )
{
// Set Host Item Basics if not set yet
if ( !isset($content["report_consdata"][ $logArray[SYSLOG_HOST] ][SYSLOG_HOST]) )
{
$content["report_consdata"][ $logArray[SYSLOG_HOST] ][SYSLOG_HOST] = $logArray[SYSLOG_HOST];
}
// Calc checksum
if ( !isset($logArray[MISC_CHECKSUM]) || $logArray[MISC_CHECKSUM] == 0 )
{
// Calc crc32 from message, we use this as index
$logArray[MISC_CHECKSUM] = crc32( $logArray[SYSLOG_MESSAGE] ); // Maybe useful somewhere else: sprintf( "%u", crc32 ( $logArray[SYSLOG_MESSAGE] ));
$strChecksum = $logArray[MISC_CHECKSUM];
// Save calculated Checksum into DB!
$this->_streamObj->SaveMessageChecksum($logArray);
}
else // Get checksum
$strChecksum = $logArray[MISC_CHECKSUM];
// Check if entry exists in result array
if ( isset($content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]) )
{
// Increment counter and set First/Last Event date
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['ItemCount']++;
// Set FirstEvent date if necessary!
if ( $logArray[SYSLOG_DATE][EVTIME_TIMESTAMP] < $content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'][EVTIME_TIMESTAMP] )
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'] = $logArray[SYSLOG_DATE];
// Set LastEvent date if necessary!
if ( $logArray[SYSLOG_DATE][EVTIME_TIMESTAMP] > $content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'][EVTIME_TIMESTAMP] )
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'] = $logArray[SYSLOG_DATE];
}
else
{
// Set Basic data entries
if (isset( $content['filter_facility_list'][$logArray[SYSLOG_FACILITY]] ))
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_FACILITY] = $logArray[SYSLOG_FACILITY];
else
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_FACILITY] = SYSLOG_LOCAL0; // Set default in this case
if (isset( $content['filter_severity_list'][$logArray[SYSLOG_SEVERITY]] ))
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SEVERITY] = $logArray[SYSLOG_SEVERITY];
else
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SEVERITY] = SYSLOG_NOTICE; // Set default in this case
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_SYSLOGTAG] = $logArray[SYSLOG_SYSLOGTAG];
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ][SYSLOG_MESSAGE] = $logArray[SYSLOG_MESSAGE];
// Set Counter and First/Last Event date
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['ItemCount'] = 1;
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['FirstOccurrence_Date'] = $logArray[SYSLOG_DATE];
$content["report_consdata"][ $logArray[SYSLOG_HOST] ]['cons_msgs'][ $strChecksum ]['LastOccurrence_Date'] = $logArray[SYSLOG_DATE];
}
}
// Get next data record
$ret = $this->_streamObj->ReadNext($uID, $logArray);
} while ( $ret == SUCCESS );
// TimeStats
$nowtime = microtime_float();
$content["report_rendertime"] .= number_format($nowtime - $gl_starttime, 2, '.', '') . "s ";
}
else
return $ret;
}
else
return $ret;
*/
// --- Start Postprocessing
foreach( $content["report_consdata"] as &$tmpConsolidatedComputer )

29
src/include/functions_common.php
View File

@ -570,7 +570,6 @@ function CheckAndSetRunMode()
// --- Check necessary PHP Extensions!
$loadedExtensions = get_loaded_extensions();
// Check for GD libary
if ( in_array("gd", $loadedExtensions) )
$content['GD_IS_ENABLED'] = true;
@ -581,6 +580,8 @@ function CheckAndSetRunMode()
if ( in_array("mysql", $loadedExtensions) ) { $content['MYSQL_IS_ENABLED'] = true; } else { $content['MYSQL_IS_ENABLED'] = false; }
// Check PDO Extension
if ( in_array("PDO", $loadedExtensions) ) { $content['PDO_IS_ENABLED'] = true; } else { $content['PDO_IS_ENABLED'] = false; }
// Check sockets Extension
if ( in_array("sockets", $loadedExtensions) ) { $content['SOCKETS_IS_ENABLED'] = true; } else { $content['SOCKETS_IS_ENABLED'] = false; }
// ---
}
@ -1347,7 +1348,31 @@ function OutputDebugMessage($szDbg, $szDbgLevel = DEBUG_INFO)
// Check if the user wants to syslog the error!
if ( GetConfigSetting("MiscDebugToSyslog", 0, CFGLEVEL_GLOBAL) == 1 )
{
$syslogSend = syslog(GetPriorityFromDebugLevel($szDbgLevel), $szDbg);
if ( $content['SOCKETS_IS_ENABLED'] )
{
// Send using UDP ourself!
$sock = @socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
$stprifac = (SYSLOG_LOCAL0 << 3);
if ( $szDbgLevel == DEBUG_ERROR_WTF )
$stprifac += SYSLOG_CRIT;
else if ( $szDbgLevel == DEBUG_ERROR )
$stprifac += SYSLOG_ERR;
else if ( $szDbgLevel == DEBUG_WARN )
$stprifac += SYSLOG_WARNING;
else if ( $szDbgLevel == DEBUG_INFO )
$stprifac += SYSLOG_NOTICE;
else if ( $szDbgLevel == DEBUG_DEBUG )
$stprifac += SYSLOG_INFO;
else if ( $szDbgLevel == DEBUG_ULTRADEBUG )
$stprifac += SYSLOG_DEBUG;
// Generate RFC5424 Syslog MSG
$szsyslogmsg = "<" . $stprifac . ">" . date("c") . " " . php_uname ("n") . " " . "loganalyzer - - - " . $szDbg ;
@socket_sendto($sock, $szsyslogmsg, strlen($szsyslogmsg), 0, '127.0.0.1', 514);
@socket_close($sock);
}
else // Use PHP System function to send via syslog
$syslogSend = syslog(GetPriorityFromDebugLevel($szDbgLevel), $szDbg);
}
}