grok 0.0.2 → 0.0.3

data/README.rdoc

@@ -21,6 +21,7 @@ There's only a few configuration parameters for Grok at this stage
 * file: The log file to watch
 * interval: How often to check the log file for changes (in seconds)
 * replay: The number of lines to read from the bottom of the file on startup
+* process: Spawn this process and feed the output into grok
 
 === Responding to log events
 At it's most basic, you can simply get Grok to print out each message as it
@@ -48,7 +49,7 @@ Getting there.  What if our user failed a couple of times over the past month?
 We don't really want to him out for that, so we'll put a time limit on the rule
 so only 3 incorrect login attempts within the past 2 minutes will trigger it.
 
-  on /sshd\[\d+\]: Failed password for ([\d\w]+) from ([\d\.]+)/, :times => 3, :withn => '2m' do |username, ip|
+  on /sshd\[\d+\]: Failed password for ([\d\w]+) from ([\d\.]+)/, :times => 3, :within => '2m' do |username, ip|
     puts "SSH authentication failure for #{username} from #{ip}"
   end
 
@@ -58,6 +59,18 @@ weeks (w), days (d), hours (h), minutes (m) and seconds (s).  For example
   '1d2h3s' => 1 day, 2 hours and 3 seconds
   '2y3m' => 2 years and 3 minutes
 
+=== Other events
+==== Exit
+You can also define event handlers to run when your script exits (for the
+purposes of printing a summary, or whatever you want).
+
+  exit do 
+    puts "Done"
+  end
+
+You can define as many of these handlers as you'd like and they'll be run
+when the Ruby process has been sent a SIGINT.
+
 == Note on Patches/Pull Requests
  
 * Fork the project.

data/VERSION

@@ -1 +1 @@
-0.0.2
+0.0.3

data/lib/grok.rb

@@ -10,7 +10,13 @@ end
 def on(match, opts={}, &block)
   $watcher.on(match, opts, &block)
 end
-  
+
+def exit(&block)
+  $watcher.exit(&block)
+end
+
+trap "SIGINT", proc { $watcher.stop }
+
 at_exit do
   unless defined?(Test::Unit)
     raise $! if $!

data/lib/grok/watcher.rb

@@ -2,7 +2,7 @@ require 'rubygems'
 require 'file/tail'
 
 module Grok
-  Config = Struct.new(:file, :interval, :replay)
+  Config = Struct.new(:file, :interval, :replay, :process)
   
   class Watcher
     attr_accessor :config, :file, :interval, :match, :replay
@@ -10,7 +10,7 @@ module Grok
     def initialize(&b)
       @events = {}
       @event_log = {}
-      @config = Config.new("/var/log/messages", 10)
+      @config = Config.new(nil, 10, 0, nil)
 
       #instance_eval(&b) if block_given?
     end
@@ -20,23 +20,38 @@ module Grok
     end
 
     def on(match, opts={}, &block)
-      event = :log
       match = match.to_s if match.is_a? Integer
       within = opts[:within] ? Grok.parse_time_string(opts[:within]) : nil
-      (@events[event] ||= []) << [Regexp.new(match), block, opts[:times], within]
+      (@events[:log] ||= []) << [Regexp.new(match), block, opts[:times], within]
+    end
+
+    def exit(&block)
+      (@events[:exit] ||= []) << block
     end
 
     def start
-      File.open(@config.file) do |log|
-        log.extend(File::Tail)
-        log.interval = @config.interval
-        log.backward(@config.replay)
-        log.tail { |line|
-          dispatch(:log, line)
+      if !@config.file.nil?
+        File.open(@config.file) do |log|
+          log.extend(File::Tail)
+          log.interval = @config.interval
+          log.backward(@config.replay)
+          log.tail { |line|
+            dispatch(:log, line)
+          }
+        end
+      elsif !@config.process.nil?
+        IO.popen(@config.process) { |fd|
+          while line = fd.gets
+            dispatch(:log, line)
+          end
         }
       end
     end
 
+    def stop
+      dispatch(:exit)
+    end
+
   private
     def find(type, log)
       if events = @events[type]
@@ -61,7 +76,12 @@ module Grok
       }
     end
 
-    def dispatch(event, log)
+    def dispatch(event, log=nil)
+      if event == :exit
+        @events[:exit].each { |block| invoke block }
+        Process.exit
+      end
+
       if handler = find(event, log)
         regexp, block, times, within = *handler
         self.match = log.match(regexp).captures

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: grok
 version: !ruby/object:Gem::Version 
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors: 
 - Tim Sharpe
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-02-14 00:00:00 +11:00
+date: 2010-02-18 00:00:00 +11:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -83,6 +83,6 @@ signing_key:
 specification_version: 3
 summary: A ruby log event correlator
 test_files: 
-- test/helper.rb
 - test/test_grok.rb
+- test/helper.rb
 - examples/ssh_sentry.rb