rec 1.1.5 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/CHANGELOG +3 -2
- data/lib/rec/correlator.rb +8 -7
- data/lib/rec/notify.rb +5 -1
- data/lib/rec/state.rb +3 -2
- metadata +4 -4
    
        data/CHANGELOG
    CHANGED
    
    
    
        data/lib/rec/correlator.rb
    CHANGED
    
    | @@ -63,7 +63,7 @@ class Correlator | |
| 63 63 | 
             
            			logLine.strip!()
         | 
| 64 64 | 
             
            			next if logLine.empty?
         | 
| 65 65 | 
             
            			@@eventsIn += 1
         | 
| 66 | 
            -
            			@@ | 
| 66 | 
            +
            			@@now, message = parse(logLine)
         | 
| 67 67 | 
             
            			$stderr.puts("< "+message) if $debug
         | 
| 68 68 | 
             
            			State.expire_states()	# remove expired states before we check the rules
         | 
| 69 69 | 
             
            			eventMatched = false
         | 
| @@ -105,16 +105,17 @@ class Correlator | |
| 105 105 | 
             
            			# Apr 22 16:40:18 aqua Firewall[205]: Skype is listening from 0.0.0.0:51304 proto=6
         | 
| 106 106 | 
             
            			time = Time.local(@year, $1, $2, $3, $4, $5, 0)
         | 
| 107 107 | 
             
            			message = $'
         | 
| 108 | 
            -
            		elsif logLine =~ /^\[\w+\]\s | 
| 108 | 
            +
            		elsif logLine =~ /^\[\w+\]\s(Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+(\d+)\s(\d\d)\:(\d\d)\:(\d\d)\s(\d{4})/
         | 
| 109 109 | 
             
            			# [err] Fri Dec 30 23:58:56 2011 - scan error: 451 SCAN Engine error 2 ...
         | 
| 110 | 
            -
            			time = Time.local($ | 
| 110 | 
            +
            			time = Time.local($7, $2, $3, $4, $5, $6, 0)
         | 
| 111 111 | 
             
            			message = $'
         | 
| 112 | 
            -
            		 | 
| 112 | 
            +
            		elsif logLine =~ /^(\d{4})\-(\d\d)\-(\d\d)[\sT](\d\d)\:(\d\d)\:(\d\d)(\S*)\s+/
         | 
| 113 113 | 
             
            			# 2012-04-22 08:43:22.099 EST - Module: PlistFile ...
         | 
| 114 | 
            -
            			 | 
| 115 | 
            -
             | 
| 114 | 
            +
            			# 2012-10-01T11:45:44+10:00 proc=sendmail status=running
         | 
| 115 | 
            +
            			if not $7.empty? and ($7.include?("UTC") or $7.include?("GMT"))
         | 
| 116 | 
            +
            				time = Time.utc($1, $2, $3, $4, $5, $6)
         | 
| 116 117 | 
             
            			else
         | 
| 117 | 
            -
            				time = Time.local($1, $2, $3, $4, $5, $6 | 
| 118 | 
            +
            				time = Time.local($1, $2, $3, $4, $5, $6)
         | 
| 118 119 | 
             
            			end
         | 
| 119 120 | 
             
            			message = $'
         | 
| 120 121 | 
             
            		else
         | 
    
        data/lib/rec/notify.rb
    CHANGED
    
    | @@ -95,7 +95,11 @@ module Notify | |
| 95 95 | 
             
            		smtp = Net::SMTP.new(@@emailServer, @@emailPort)
         | 
| 96 96 | 
             
            		smtp.enable_starttls()
         | 
| 97 97 | 
             
            		smtp.start(@@emailDomain, @@emailUser, @@emailPassword, :plain)
         | 
| 98 | 
            -
            		 | 
| 98 | 
            +
            		message = []
         | 
| 99 | 
            +
            		message << "To: #{recipient}\n"
         | 
| 100 | 
            +
            		message << "Subject: #{subject}\n\n"
         | 
| 101 | 
            +
            		message << alert
         | 
| 102 | 
            +
            		smtp.send_message(message, @@emailUser, recipient)
         | 
| 99 103 | 
             
            		smtp.finish()
         | 
| 100 104 | 
             
            	end
         | 
| 101 105 |  | 
    
        data/lib/rec/state.rb
    CHANGED
    
    | @@ -119,7 +119,8 @@ class State | |
| 119 119 | 
             
            	# - template is a string like "Server %host$s is down"
         | 
| 120 120 | 
             
            	# - state is the current state
         | 
| 121 121 | 
             
            	def self.find(template, state)
         | 
| 122 | 
            -
            		title = template.sprinth(state. | 
| 122 | 
            +
            		title = template.sprinth(state.details)
         | 
| 123 | 
            +
            		puts("finding state '#{title}'")
         | 
| 123 124 | 
             
            		@@states[title]
         | 
| 124 125 | 
             
            	end
         | 
| 125 126 |  | 
| @@ -229,7 +230,7 @@ class State | |
| 229 230 | 
             
            	def generate(sym = :alert)
         | 
| 230 231 | 
             
            		message = @params[sym].sprinth(stats())
         | 
| 231 232 | 
             
            		if message.length > 0
         | 
| 232 | 
            -
            			event = "%s %s" % [@ | 
| 233 | 
            +
            			event = "%s %s" % [@updated.iso8601, message] + @logs.join("\n")
         | 
| 233 234 | 
             
            			print("> ") if $debug
         | 
| 234 235 | 
             
            			puts(event)
         | 
| 235 236 | 
             
            			@@eventsOut = @@eventsOut + 1
         | 
    
        metadata
    CHANGED
    
    | @@ -1,13 +1,13 @@ | |
| 1 1 | 
             
            --- !ruby/object:Gem::Specification 
         | 
| 2 2 | 
             
            name: rec
         | 
| 3 3 | 
             
            version: !ruby/object:Gem::Version 
         | 
| 4 | 
            -
              hash:  | 
| 4 | 
            +
              hash: 31
         | 
| 5 5 | 
             
              prerelease: 
         | 
| 6 6 | 
             
              segments: 
         | 
| 7 7 | 
             
              - 1
         | 
| 8 | 
            -
              -  | 
| 9 | 
            -
              -  | 
| 10 | 
            -
              version: 1. | 
| 8 | 
            +
              - 2
         | 
| 9 | 
            +
              - 0
         | 
| 10 | 
            +
              version: 1.2.0
         | 
| 11 11 | 
             
            platform: ruby
         | 
| 12 12 | 
             
            authors: 
         | 
| 13 13 | 
             
            - Richard Kernahan
         |