rec 1.1.5 → 1.2.0
Sign up to get free protection for your applications and to get access to all the features.
- data/CHANGELOG +3 -2
- data/lib/rec/correlator.rb +8 -7
- data/lib/rec/notify.rb +5 -1
- data/lib/rec/state.rb +3 -2
- metadata +4 -4
data/CHANGELOG
CHANGED
data/lib/rec/correlator.rb
CHANGED
@@ -63,7 +63,7 @@ class Correlator
|
|
63
63
|
logLine.strip!()
|
64
64
|
next if logLine.empty?
|
65
65
|
@@eventsIn += 1
|
66
|
-
@@
|
66
|
+
@@now, message = parse(logLine)
|
67
67
|
$stderr.puts("< "+message) if $debug
|
68
68
|
State.expire_states() # remove expired states before we check the rules
|
69
69
|
eventMatched = false
|
@@ -105,16 +105,17 @@ class Correlator
|
|
105
105
|
# Apr 22 16:40:18 aqua Firewall[205]: Skype is listening from 0.0.0.0:51304 proto=6
|
106
106
|
time = Time.local(@year, $1, $2, $3, $4, $5, 0)
|
107
107
|
message = $'
|
108
|
-
elsif logLine =~ /^\[\w+\]\s
|
108
|
+
elsif logLine =~ /^\[\w+\]\s(Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+(\d+)\s(\d\d)\:(\d\d)\:(\d\d)\s(\d{4})/
|
109
109
|
# [err] Fri Dec 30 23:58:56 2011 - scan error: 451 SCAN Engine error 2 ...
|
110
|
-
time = Time.local($
|
110
|
+
time = Time.local($7, $2, $3, $4, $5, $6, 0)
|
111
111
|
message = $'
|
112
|
-
|
112
|
+
elsif logLine =~ /^(\d{4})\-(\d\d)\-(\d\d)[\sT](\d\d)\:(\d\d)\:(\d\d)(\S*)\s+/
|
113
113
|
# 2012-04-22 08:43:22.099 EST - Module: PlistFile ...
|
114
|
-
|
115
|
-
|
114
|
+
# 2012-10-01T11:45:44+10:00 proc=sendmail status=running
|
115
|
+
if not $7.empty? and ($7.include?("UTC") or $7.include?("GMT"))
|
116
|
+
time = Time.utc($1, $2, $3, $4, $5, $6)
|
116
117
|
else
|
117
|
-
time = Time.local($1, $2, $3, $4, $5, $6
|
118
|
+
time = Time.local($1, $2, $3, $4, $5, $6)
|
118
119
|
end
|
119
120
|
message = $'
|
120
121
|
else
|
data/lib/rec/notify.rb
CHANGED
@@ -95,7 +95,11 @@ module Notify
|
|
95
95
|
smtp = Net::SMTP.new(@@emailServer, @@emailPort)
|
96
96
|
smtp.enable_starttls()
|
97
97
|
smtp.start(@@emailDomain, @@emailUser, @@emailPassword, :plain)
|
98
|
-
|
98
|
+
message = []
|
99
|
+
message << "To: #{recipient}\n"
|
100
|
+
message << "Subject: #{subject}\n\n"
|
101
|
+
message << alert
|
102
|
+
smtp.send_message(message, @@emailUser, recipient)
|
99
103
|
smtp.finish()
|
100
104
|
end
|
101
105
|
|
data/lib/rec/state.rb
CHANGED
@@ -119,7 +119,8 @@ class State
|
|
119
119
|
# - template is a string like "Server %host$s is down"
|
120
120
|
# - state is the current state
|
121
121
|
def self.find(template, state)
|
122
|
-
title = template.sprinth(state.
|
122
|
+
title = template.sprinth(state.details)
|
123
|
+
puts("finding state '#{title}'")
|
123
124
|
@@states[title]
|
124
125
|
end
|
125
126
|
|
@@ -229,7 +230,7 @@ class State
|
|
229
230
|
def generate(sym = :alert)
|
230
231
|
message = @params[sym].sprinth(stats())
|
231
232
|
if message.length > 0
|
232
|
-
event = "%s %s" % [@
|
233
|
+
event = "%s %s" % [@updated.iso8601, message] + @logs.join("\n")
|
233
234
|
print("> ") if $debug
|
234
235
|
puts(event)
|
235
236
|
@@eventsOut = @@eventsOut + 1
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rec
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 31
|
5
5
|
prerelease:
|
6
6
|
segments:
|
7
7
|
- 1
|
8
|
-
-
|
9
|
-
-
|
10
|
-
version: 1.
|
8
|
+
- 2
|
9
|
+
- 0
|
10
|
+
version: 1.2.0
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- Richard Kernahan
|