Re: [PATCH resend] http: add eval multi-field ignore mechanism

>From e048278566e1edcebad0bb8ec6e8eebfe1ef08a1 Mon Sep 17 00:00:00 2001
From: Matthew Ogilvie <[email protected]>
Date: Wed, 14 Aug 2013 23:28:33 -0600
Subject: [PATCH resend] http: add eval multi-field ignore mechanism

This adds a configuration option HTTP_IGNORE_EVAL for the http service
which you can be set to arbitrary code to eval to do arbitrary tests
against multiple log file fields.  Useful if you want to define narrower
ignore rules than you can get with previous ignore mechanisms that each
only test a single field.

Unless you override the new option, everything behaves like it used to,
including older ignore mechanisms.
---

This is a resend of a patch I tried to send over a year ago, but
have not heard any feedback.  Only the subject changed slightly; it was:
"[PATCH] http: add ignore mechanism that can test multiple fields".

I've been using this the whole time on some of my machines.

 conf/services/http.conf |  8 ++++++++
 scripts/services/http   | 19 +++++++++++++------
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/conf/services/http.conf b/conf/services/http.conf
index ec34c17..ce1b433 100644
--- a/conf/services/http.conf
+++ b/conf/services/http.conf
@@ -60,6 +60,14 @@ $HTTP_IGNORE_ERROR_HACKS = 0
 #   $HTTP_IGNORE_IPS = ^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.
 #
 
+# For more sophisticated ignore rules, you can define HTTP_IGNORE_EVAL
+# to an arbitrary chunk of code.
+# The default is not to filter anything:
+$HTTP_IGNORE_EVAL = 0
+# Example:
+# $HTTP_IGNORE_EVAL = "($field{http_rc} == 401) && ($field{client_ip}=~/^192\.168\./) && ($field{url}=~m%^/protected1/%)"
+# See the "scripts/services/http" script for other variables that can be tested.
+
 # The variable $HTTP_USER_DISPLAY defines which user accesses are displayed.
 # The default is not to display user accesses:
 $HTTP_USER_DISPLAY = 0
diff --git a/scripts/services/http b/scripts/services/http
index a80f5d1..fbaa726 100755
--- a/scripts/services/http
+++ b/scripts/services/http
@@ -134,6 +134,7 @@ use Logwatch ':sort';
 my $detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 my $ignoreURLs = $ENV{'http_ignore_urls'};
 my $ignoreIPs = $ENV{'http_ignore_ips'};
+my $ignoreEval = $ENV{'http_ignore_eval'};
 my $ignore_error_hacks = $ENV{'http_ignore_error_hacks'} || 0;
 my $user_display = $ENV{'http_user_display'};
 my $logformat = "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"|%h %l %u %t \"%r\" %>s %b|%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b";
@@ -573,9 +574,7 @@ while (my $line = <STDIN>) {
       $other_count += 1;
       $other_bytes += $field{bytes_transfered};
    }
-   if ( ($field{http_rc} >= 400) &&
-         !((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) &&
-         !((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+   if ( ($field{http_rc} >= 400) && !shouldIgnore("needs_exam") ) {
       my $fmt_url = $field{url};
       if (length($field{url}) > 60) {
          $fmt_url = substr($field{url},0,42) . " ... " .
@@ -584,9 +583,7 @@ while (my $line = <STDIN>) {
       $needs_exam{$field{http_rc}}{$fmt_url}++;
    }
    if (defined $field{userid} && $field{userid} ne "-" &&
-         (eval $user_display) &&
-         !((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) &&
-         !((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+         (eval $user_display) && !shouldIgnore("users_logged") ) {
        $users_logged{$field{userid}}{$field{client_ip}}++;
    }
 
@@ -791,6 +788,16 @@ if ($notparsed) {
 
 exit (0);
 
+sub shouldIgnore {
+   my($context)=@_;
+
+   if( ((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) ||
+       ((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+      return 1;
+   }
+   return (eval $ignoreEval);
+}
+
 # vi: shiftwidth=3 tabstop=3 syntax=perl et
 # Local Variables:
 # mode: perl
-- 
1.7.10.2.484.gcd07cc5