prelude-correlator/master: Implement logging subsystem.
[email protected] Thu, 18 Jun 2009 15:33:16 +0200 (CEST)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit 48169894c0ced9744f3e52ee399944750764ef7f Author: Yoann Vandoorselaere <[email protected]> Date: Thu Jun 18 12:44:42 2009 +0200 Implement logging subsystem. Implement PreludeCorrelator.log, providing basic logging functionality, and spread its use accross correlator sources. Avoid using global as much as possible. ======================================== PreludeCorrelator/context.py | 6 ++-- PreludeCorrelator/log.py | 44 ++++++++++++++++++++++ PreludeCorrelator/main.py | 61 ++++++++++++++++++------------- PreludeCorrelator/pluginmanager.py | 7 +++- PreludeCorrelator/plugins/dshield.py | 9 +++-- prelude_correlator.egg-info/SOURCES.txt | 1 + 6 files changed, 95 insertions(+), 33 deletions(-) ======================================== diff --git a/PreludeCorrelator/context.py b/PreludeCorrelator/context.py index cb9ba02..bde0b0d 100644 --- a/PreludeCorrelator/context.py +++ b/PreludeCorrelator/context.py @@ -137,10 +137,10 @@ def wakeup(now): timer._timerExpireCallback() -def stats(): +def stats(logger): now = time.time() for ctx in _CONTEXT_TABLE.values(): if not ctx._start: - print("[%s]: threshold=%d" % (ctx._name, ctx._threshold)) + logger.info("[%s]: threshold=%d" % (ctx._name, ctx._threshold)) else: - print("[%s]: threshold=%d expire=%d" % (ctx._name, ctx._threshold, ctx._expire - (now - ctx._start))) + logger.info("[%s]: threshold=%d expire=%d" % (ctx._name, ctx._threshold, ctx._expire - (now - ctx._start))) diff --git a/PreludeCorrelator/log.py b/PreludeCorrelator/log.py new file mode 100644 index 0000000..89f6b0a --- /dev/null +++ b/PreludeCorrelator/log.py @@ -0,0 +1,44 @@ +# Copyright (C) 2009 PreludeIDS Technologies. All Rights Reserved. +# Author: Yoann Vandoorselaere <[email protected]> +# +# This file is part of the Prelude-Correlator program. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; see the file COPYING. If not, write to +# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. + + +import logging, logging.config, logging.handlers, sys, os, siteconfig + +class Log(logging.Logger): + def __init__(self): + try: + logging.config.fileConfig(siteconfig.conf_dir + "/prelude-correlator.conf") + except Exception, e: + DATEFMT = "%d %b %H:%M:%S" + FORMAT="%(asctime)s (process:%(pid)d) %(levelname)s: %(message)s" + logging.basicConfig(level=logging.DEBUG, format=FORMAT, datefmt=DATEFMT, stream=sys.stderr) + + self._logger = logging.getLogger("prelude-correlator") + + def debug(self, log): + self._logger.debug(log, extra = { "pid": os.getpid() }) + + def info(self, log): + self._logger.info(log, extra = { "pid": os.getpid() }) + + def warning(self, log): + self._logger.warning(log, extra = { "pid": os.getpid() }) + + def critical(self, log): + self._logger.critical(log, extra = { "pid": os.getpid() }) diff --git a/PreludeCorrelator/main.py b/PreludeCorrelator/main.py index 4653f9b..c443c71 100644 --- a/PreludeCorrelator/main.py +++ b/PreludeCorrelator/main.py @@ -21,20 +21,38 @@ import pkg_resources import sys, os, time, signal -from PreludeCorrelator import idmef, pluginmanager, context, siteconfig from optparse import OptionParser from PreludeEasy import ClientEasy, CheckVersion +from PreludeCorrelator import idmef, pluginmanager, context, siteconfig, log -prelude_client = None VERSION = pkg_resources.get_distribution('prelude-correlator').version -if not CheckVersion(siteconfig.libprelude_required_version): - raise Exception, ("Libprelude version '%s' is required" % siteconfig.libprelude_required_version) +class Env: + def __init__(self): + self.logger = log.Log() + + +class SignalHandler: + def __init__(self, env): + self._env = env + signal.signal(signal.SIGTERM, self._handle_signal) + signal.signal(signal.SIGINT, self._handle_signal) + signal.signal(signal.SIGQUIT, self._handle_signal) + + def _handle_signal(self, signum, frame): + self._env.logger.info("caught signal %d" % signum) + if signum == signal.SIGQUIT: + self._env.prelude_client.stats() + context.stats(self._env.logger) + else: + self._env.prelude_client.stop() + class PreludeClient: - def __init__(self, print_input=None, print_output=None, dry_run=False): + def __init__(self, env, print_input=None, print_output=None, dry_run=False): + self._env = env self._message_processed = 0 self._alert_generated = 0 self._print_input = print_input @@ -42,11 +60,12 @@ class PreludeClient: self._continue = True self._dry_run = dry_run - self._pm = pluginmanager.PluginManager() - print ("%d plugin have been loaded." % (self._pm.getPluginCount())) + self._pm = pluginmanager.PluginManager(env) + self._env.logger.info("%d plugin have been loaded." % (self._pm.getPluginCount())) self._client = ClientEasy("prelude-correlator", ClientEasy.PERMISSION_IDMEF_READ|ClientEasy.PERMISSION_IDMEF_WRITE, - "Prelude-Correlator", "Correlator", "PreludeIDS Technologies", VERSION) + "Prelude-Correlator", "Correlator", "PreludeIDS Technologies", + VERSION) self._client.Start() @@ -58,7 +77,7 @@ class PreludeClient: self._message_processed += 1 def stats(self): - print("%d message received, %d correlationAlert generated." % (self._message_processed, self._alert_generated)) + self._env.logger.info("%d message received, %d correlationAlert generated." % (self._message_processed, self._alert_generated)) def correlationAlert(self, idmef): self._alert_generated = self._alert_generated + 1 @@ -93,16 +112,11 @@ class PreludeClient: self._continue = False -def handle_signal(signum, frame): - print 'Signal handler called with signal', signum - if signum == signal.SIGQUIT: - prelude_client.stats() - context.stats() - else: - prelude_client.stop() - def main(): - global prelude_client + if not CheckVersion(siteconfig.libprelude_required_version): + raise Exception, ("Libprelude version '%s' is required" % siteconfig.libprelude_required_version) + + env = Env() parser = OptionParser(usage="%prog", version="%prog " + VERSION) parser.add_option("-c", "--config", action="store", dest="config", type="string", help="Configuration file to use", metavar="FILE") @@ -146,18 +160,15 @@ def main(): if options.pidfile: open(pidfile, "w").write(str(os.getpid())) - prelude_client = PreludeClient(print_input=ifd, print_output=ofd, dry_run=options.dry_run) - idmef.set_prelude_client(prelude_client) + env.prelude_client = PreludeClient(env, print_input=ifd, print_output=ofd, dry_run=options.dry_run) + idmef.set_prelude_client(env.prelude_client) - signal.signal(signal.SIGTERM, handle_signal) - signal.signal(signal.SIGINT, handle_signal) - signal.signal(signal.SIGQUIT, handle_signal) + SignalHandler(env) # restore previous context. context.load() - prelude_client.recvEvent() + env.prelude_client.recvEvent() # save existing context context.save() - diff --git a/PreludeCorrelator/pluginmanager.py b/PreludeCorrelator/pluginmanager.py index a63c5c3..d2e706b 100644 --- a/PreludeCorrelator/pluginmanager.py +++ b/PreludeCorrelator/pluginmanager.py @@ -30,6 +30,9 @@ ENTRYPOINT = 'PreludeCorrelator.plugins' class Plugin(object): enable = True + def __init__(self, env): + self.env = env + def getConfigValue(self, key, replacement=None): if not config.has_section(self.__class__.__name__): return replacement @@ -44,14 +47,14 @@ class Plugin(object): class PluginManager: - def __init__(self): + def __init__(self, env): self._count = 0 self.__instances = [] for entrypoint in pkg_resources.iter_entry_points(ENTRYPOINT): plugin_class = entrypoint.load() - self.__instances.append(plugin_class()) + self.__instances.append(plugin_class(env)) self._count += 1 def getPluginCount(self): diff --git a/PreludeCorrelator/plugins/dshield.py b/PreludeCorrelator/plugins/dshield.py index 58ce320..f382347 100644 --- a/PreludeCorrelator/plugins/dshield.py +++ b/PreludeCorrelator/plugins/dshield.py @@ -51,7 +51,8 @@ class DshieldPlugin(Plugin): except: pass - print("Downloading host list from dshield, this might take some time...") + self.env.logger.info("Downloading host list from dshield, this might take some time...") + con = httplib.HTTPConnection(self.__server) con.request("GET", self.__uri) r = con.getresponse() @@ -62,11 +63,13 @@ class DshieldPlugin(Plugin): fd.write(r.read()) fd.close() - print("Downloading done, processing data.") + self.env.logger.info("Downloading done, processing data.") self.__loadData(fname) - def __init__(self): + def __init__(self, env): + Plugin.__init__(self, env) + self.__iphash = { } self.__reload = self.getConfigValue("reload", self.DSHIELD_RELOAD) self.__server = self.getConfigValue("server", self.DSHIELD_SERVER) diff --git a/prelude_correlator.egg-info/SOURCES.txt b/prelude_correlator.egg-info/SOURCES.txt index fdf8e5a..ededff5 100644 --- a/prelude_correlator.egg-info/SOURCES.txt +++ b/prelude_correlator.egg-info/SOURCES.txt @@ -9,6 +9,7 @@ setup.py PreludeCorrelator/__init__.py PreludeCorrelator/context.py PreludeCorrelator/idmef.py +PreludeCorrelator/log.py PreludeCorrelator/main.py PreludeCorrelator/pluginmanager.py PreludeCorrelator/siteconfig.py _______________________________________________ Prelude-cvslog site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog