| Newsgroups |
gmane.comp.log.logwatch.devel |
| Message-ID |
<[email protected]> |
Revision: 62
http://logwatch.svn.sourceforge.net/logwatch/?rev=62&view=rev
Author: opoplawski
Date: 2011-06-29 21:30:06 +0000 (Wed, 29 Jun 2011)
Log Message:
-----------
Fix eventlog scripts for SNARE 4.0 and make more robust in general.
Modified Paths:
--------------
scripts/services/evtapplication
scripts/services/evtsecurity
scripts/services/evtsystem
scripts/shared/eventlogonlyservice
scripts/shared/eventlogremoveservice
Modified: scripts/services/evtapplication
===================================================================
--- scripts/services/evtapplication 2011-06-25 20:30:31 UTC (rev 61)
+++ scripts/services/evtapplication 2011-06-29 21:30:06 UTC (rev 62)
@@ -34,9 +34,17 @@
my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
while (defined($ThisLine = <STDIN>)) {
- #Parse
- my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$Application,$UserName,$SIDType,$EventLogType,$ComputerName,$CategoryString,$DataString,$ExpandedString,$Extra) =
- ($ThisLine =~ /(\w+)\sMSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ my ($Criticality,$SourceName,$DateTime,$EventID,$Application,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra);
+ #Determine format
+ if ($ThisLine =~ /MSWinEventLog\[/) { # Snare 4
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$Application,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /(\S+)\sMSWinEventLog\[(\d+)\]:(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ } elsif ($ThisLine =~ /MSWinEventLog\t/) { # Snare 3
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$Application,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ }
if (!defined($Hostname)) {
print STDERR "Cannot parse $ThisLine";
next;
Modified: scripts/services/evtsecurity
===================================================================
--- scripts/services/evtsecurity 2011-06-25 20:30:31 UTC (rev 61)
+++ scripts/services/evtsecurity 2011-06-29 21:30:06 UTC (rev 62)
@@ -32,9 +32,17 @@
my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
while (defined($ThisLine = <STDIN>)) {
- #Parse
- my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$SourceName2,$UserName,$SIDType,$EventLogType,$ComputerName,$CategoryString,$DataString,$ExpandedString,$Extra) =
- ($ThisLine =~ /(\w+) MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t(\w+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]*)\t([^\t]*)\t([^\t]*)/);
+ my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$SourceName2,$UserName,$SIDType,$EventLogType,$CategoryString,$DataString,$ExpandedString,$Extra);
+ #Determine format
+ if ($ThisLine =~ /MSWinEventLog\[/) { # Snare 4
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$SourceName2,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /MSWinEventLog\[(\d+)\]:(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ } elsif ($ThisLine =~ /MSWinEventLog\t/) { # Snare 3
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$SourceName2,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ }
if (!defined($Hostname)) {
print STDERR "Cannot parse $ThisLine";
next;
Modified: scripts/services/evtsystem
===================================================================
--- scripts/services/evtsystem 2011-06-25 20:30:31 UTC (rev 61)
+++ scripts/services/evtsystem 2011-06-29 21:30:06 UTC (rev 62)
@@ -33,9 +33,17 @@
my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
while (defined($ThisLine = <STDIN>)) {
- #Parse
- my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$ComputerName,$CategoryString,$DataString,$ExpandedString,$Extra) =
- ($ThisLine =~ /(\w+)\sMSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$CategoryString,$DataString,$ExpandedString,$Extra);
+ #Determine format
+ if ($ThisLine =~ /MSWinEventLog\[/) { # Snare 4
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /MSWinEventLog\[(\d+)\]:(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ } elsif ($ThisLine =~ /MSWinEventLog\t/) { # Snare 3
+ #Parse
+ ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
+ ($ThisLine =~ /MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
+ }
if (!defined($Hostname)) {
print STDERR "Cannot parse $ThisLine";
next;
Modified: scripts/shared/eventlogonlyservice
===================================================================
--- scripts/shared/eventlogonlyservice 2011-06-25 20:30:31 UTC (rev 61)
+++ scripts/shared/eventlogonlyservice 2011-06-29 21:30:06 UTC (rev 62)
@@ -38,7 +38,7 @@
}
while (defined($ThisLine = <STDIN>)) {
- if ($ThisLine =~ m/^... .. ..:..:.. \w+ \w+ \w+\t\d+\t$ServiceName\t\d/oi) {
+ if ($ThisLine =~ m/^... .. ..:..:.. .* MSWinEventLog(\t\d+\t|\[\d+\]:)$ServiceName\t/oi) {
print $ThisLine;
}
}
Modified: scripts/shared/eventlogremoveservice
===================================================================
--- scripts/shared/eventlogremoveservice 2011-06-25 20:30:31 UTC (rev 61)
+++ scripts/shared/eventlogremoveservice 2011-06-29 21:30:06 UTC (rev 62)
@@ -48,7 +48,7 @@
while (defined($ThisLine = <STDIN>)) {
$linesin++;
- unless ($ThisLine =~ m/^... .. ..:..:.. \w+ \w+ \w+\t\d+\t$ServiceName\t\d/oi) {
+ unless ($ThisLine =~ m/^... .. ..:..:.. .* MSWinEventLog(\t\d+\t|\[\d+\]:)$ServiceName\t/oi) {
$linesout++;
print $ThisLine;
}
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security
threats, fraudulent activity, and more. Splunk takes this data and makes
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2