rec 1.1.5 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/CHANGELOG +3 -2
- data/lib/rec/correlator.rb +8 -7
- data/lib/rec/notify.rb +5 -1
- data/lib/rec/state.rb +3 -2
- metadata +4 -4
data/CHANGELOG
CHANGED
data/lib/rec/correlator.rb
CHANGED
@@ -63,7 +63,7 @@ class Correlator
|
|
63
63
|
logLine.strip!()
|
64
64
|
next if logLine.empty?
|
65
65
|
@@eventsIn += 1
|
66
|
-
@@
|
66
|
+
@@now, message = parse(logLine)
|
67
67
|
$stderr.puts("< "+message) if $debug
|
68
68
|
State.expire_states() # remove expired states before we check the rules
|
69
69
|
eventMatched = false
|
@@ -105,16 +105,17 @@ class Correlator
|
|
105
105
|
# Apr 22 16:40:18 aqua Firewall[205]: Skype is listening from 0.0.0.0:51304 proto=6
|
106
106
|
time = Time.local(@year, $1, $2, $3, $4, $5, 0)
|
107
107
|
message = $'
|
108
|
-
elsif logLine =~ /^\[\w+\]\s
|
108
|
+
elsif logLine =~ /^\[\w+\]\s(Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+(\d+)\s(\d\d)\:(\d\d)\:(\d\d)\s(\d{4})/
|
109
109
|
# [err] Fri Dec 30 23:58:56 2011 - scan error: 451 SCAN Engine error 2 ...
|
110
|
-
time = Time.local($
|
110
|
+
time = Time.local($7, $2, $3, $4, $5, $6, 0)
|
111
111
|
message = $'
|
112
|
-
|
112
|
+
elsif logLine =~ /^(\d{4})\-(\d\d)\-(\d\d)[\sT](\d\d)\:(\d\d)\:(\d\d)(\S*)\s+/
|
113
113
|
# 2012-04-22 08:43:22.099 EST - Module: PlistFile ...
|
114
|
-
|
115
|
-
|
114
|
+
# 2012-10-01T11:45:44+10:00 proc=sendmail status=running
|
115
|
+
if not $7.empty? and ($7.include?("UTC") or $7.include?("GMT"))
|
116
|
+
time = Time.utc($1, $2, $3, $4, $5, $6)
|
116
117
|
else
|
117
|
-
time = Time.local($1, $2, $3, $4, $5, $6
|
118
|
+
time = Time.local($1, $2, $3, $4, $5, $6)
|
118
119
|
end
|
119
120
|
message = $'
|
120
121
|
else
|
data/lib/rec/notify.rb
CHANGED
@@ -95,7 +95,11 @@ module Notify
|
|
95
95
|
smtp = Net::SMTP.new(@@emailServer, @@emailPort)
|
96
96
|
smtp.enable_starttls()
|
97
97
|
smtp.start(@@emailDomain, @@emailUser, @@emailPassword, :plain)
|
98
|
-
|
98
|
+
message = []
|
99
|
+
message << "To: #{recipient}\n"
|
100
|
+
message << "Subject: #{subject}\n\n"
|
101
|
+
message << alert
|
102
|
+
smtp.send_message(message, @@emailUser, recipient)
|
99
103
|
smtp.finish()
|
100
104
|
end
|
101
105
|
|
data/lib/rec/state.rb
CHANGED
@@ -119,7 +119,8 @@ class State
|
|
119
119
|
# - template is a string like "Server %host$s is down"
|
120
120
|
# - state is the current state
|
121
121
|
def self.find(template, state)
|
122
|
-
title = template.sprinth(state.
|
122
|
+
title = template.sprinth(state.details)
|
123
|
+
puts("finding state '#{title}'")
|
123
124
|
@@states[title]
|
124
125
|
end
|
125
126
|
|
@@ -229,7 +230,7 @@ class State
|
|
229
230
|
def generate(sym = :alert)
|
230
231
|
message = @params[sym].sprinth(stats())
|
231
232
|
if message.length > 0
|
232
|
-
event = "%s %s" % [@
|
233
|
+
event = "%s %s" % [@updated.iso8601, message] + @logs.join("\n")
|
233
234
|
print("> ") if $debug
|
234
235
|
puts(event)
|
235
236
|
@@eventsOut = @@eventsOut + 1
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rec
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 31
|
5
5
|
prerelease:
|
6
6
|
segments:
|
7
7
|
- 1
|
8
|
-
-
|
9
|
-
-
|
10
|
-
version: 1.
|
8
|
+
- 2
|
9
|
+
- 0
|
10
|
+
version: 1.2.0
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- Richard Kernahan
|