Andrew's git - logparse.git/blob - logparse/parsers/smbd.py

   1#
   2#   smbd.py
   3#   
   4#   Get login statistics for a samba server.
   5#
   6#   NOTE: This file is now deprecated in favour of the newer journald mechanism
   7#   used in smbd-journald.py. This parser is still functional but is slower and
   8#   has less features. Please switch over if possible.
   9#
  10
  11import re
  12import glob
  13
  14from logparse.formatting import *
  15from logparse.util import readlog, resolve
  16from logparse import config
  17from logparse.load_parsers import Parser
  18
  19class Smbd(Parser):
  20
  21    def __init__(self):
  22        super().__init__()
  23        self.name = "smbd"
  24        self.info = "Get login statistics for a samba server."
  25        self.deprecated = True
  26        self.successor = "smbd_journald"
  27
  28    def parse_log(self):
  29        logger.debug("Starting smbd section")
  30        section = Section("smbd")
  31        files = glob.glob(config.prefs.get("logs", "smbd") + "/log.*[!\.gz][!\.old]")    # find list of logfiles
  32        # for f in files:
  33
  34            # file_mod_time = os.stat(f).st_mtime
  35
  36            # Time in seconds since epoch for time, in which logfile can be unmodified.
  37            # should_time = time.time() - (30 * 60)
  38
  39            # Time in minutes since last modification of file
  40            # last_time = (time.time() - file_mod_time)
  41            # logger.debug(last_time)
  42
  43            # if (file_mod_time - should_time) < args.time:
  44                # print "CRITICAL: {} last modified {:.2f} minutes. Threshold set to 30 minutes".format(last_time, file, last_time)
  45            # else:
  46
  47            # if (datetime.timedelta(datetime.datetime.now() - datetime.fromtimestamp(os.path.getmtime(f))).days > 7):
  48                # files.remove(f)
  49        logger.debug("Found log files " + str(files))
  50        n_auths = 0         # total number of logins from all users
  51        sigma_auths = []    # contains users
  52
  53        for file in files:  # one log file for each client
  54
  55            logger.debug("Looking at file " + file)
  56
  57            # find the machine (ip or hostname) that this file represents
  58            ip = re.search('log\.(.*)', file).group(1)    # get ip or hostname from file path (/var/log/samba/log.host)
  59            host = resolve(ip, fqdn=config.prefs.get("smbd", "smbd-resolve-domains"))
  60            if host == ip and (config.prefs.get("smbd", "smbd-resolve-domains") != "ip" or config.prefs.get("logparse", "resolve-domains") != "ip"):    # if ip has disappeared, fall back to a hostname from logfile
  61                newhost = re.findall('.*\]\@\[(.*)\]', readlog(file))
  62                if (len(set(newhost)) == 1):    # all hosts in one file should be the same
  63                    host = newhost[0].lower()
  64
  65            # count number of logins from each user-host pair
  66            matches = re.findall('.*(?:authentication for user \[|connect to service .* initially as user )(\S*)(?:\] .*succeeded| \()', readlog(file))
  67            for match in matches:
  68                userhost = match + "@" + host
  69                sigma_auths.append(userhost)
  70                # exists = [i for i, item in enumerate(sigma_auths) if re.search(userhost, item[0])]
  71                # if (exists == []):
  72                #     sigma_auths.append([userhost, 1])
  73                # else:
  74                #     sigma_auths[exists[0]][1] += 1
  75                n_auths += 1
  76        auth_data = Data(subtitle=plural("login", n_auths) + " from")
  77        if (len(sigma_auths) == 1):             # if only one user, do not display no of logins for this user
  78            auth_data.subtitle += ' ' + sigma_auths[0][0]
  79            section.append_data(auth_data)
  80        else:       # multiple users
  81            auth_data.items = sigma_auths
  82            auth_data.orderbyfreq()
  83            auth_data.truncl(config.prefs.getint("logparse", "maxlist"))
  84            logger.debug("Found {0} samba logins".format(str(n_auths)))
  85        section.append_data(auth_data)
  86        logger.info("Finished smbd section")
  87        return section