1# 2# smbd.py 3# 4# Get login statistics for a samba server. 5# 6# NOTE: This file is now deprecated in favour of the newer journald mechanism 7# used in smbd-journald.py. This parser is still functional but is slower and 8# has less features. Please switch over if possible. 9# 10 11import re 12import glob 13 14from logparse.formatting import * 15from logparse.util import readlog, resolve 16from logparse import config 17from logparse.load_parsers import Parser 18 19class Smbd(Parser): 20 21 def __init__(self): 22 super().__init__() 23 self.name = "smbd" 24 self.info = "Get login statistics for a samba server." 25 self.deprecated = True 26 self.successor = "smbd_journald" 27 28 def parse_log(self): 29 logger.debug("Starting smbd section") 30 section = Section("smbd") 31 files = glob.glob(config.prefs.get("logs", "smbd") + "/log.*[!\.gz][!\.old]") # find list of logfiles 32 # for f in files: 33 34 # file_mod_time = os.stat(f).st_mtime 35 36 # Time in seconds since epoch for time, in which logfile can be unmodified. 37 # should_time = time.time() - (30 * 60) 38 39 # Time in minutes since last modification of file 40 # last_time = (time.time() - file_mod_time) 41 # logger.debug(last_time) 42 43 # if (file_mod_time - should_time) < args.time: 44 # print "CRITICAL: {} last modified {:.2f} minutes. Threshold set to 30 minutes".format(last_time, file, last_time) 45 # else: 46 47 # if (datetime.timedelta(datetime.datetime.now() - datetime.fromtimestamp(os.path.getmtime(f))).days > 7): 48 # files.remove(f) 49 logger.debug("Found log files " + str(files)) 50 n_auths = 0 # total number of logins from all users 51 sigma_auths = [] # contains users 52 53 for file in files: # one log file for each client 54 55 logger.debug("Looking at file " + file) 56 57 # find the machine (ip or hostname) that this file represents 58 ip = re.search('log\.(.*)', file).group(1) # get ip or hostname from file path (/var/log/samba/log.host) 59 host = resolve(ip, fqdn=config.prefs.get("smbd", "smbd-resolve-domains")) 60 if host == ip and (config.prefs.get("smbd", "smbd-resolve-domains") != "ip" or config.prefs.get("logparse", "resolve-domains") != "ip"): # if ip has disappeared, fall back to a hostname from logfile 61 newhost = re.findall('.*\]\@\[(.*)\]', readlog(file)) 62 if (len(set(newhost)) == 1): # all hosts in one file should be the same 63 host = newhost[0].lower() 64 65 # count number of logins from each user-host pair 66 matches = re.findall('.*(?:authentication for user \[|connect to service .* initially as user )(\S*)(?:\] .*succeeded| \()', readlog(file)) 67 for match in matches: 68 userhost = match + "@" + host 69 sigma_auths.append(userhost) 70 # exists = [i for i, item in enumerate(sigma_auths) if re.search(userhost, item[0])] 71 # if (exists == []): 72 # sigma_auths.append([userhost, 1]) 73 # else: 74 # sigma_auths[exists[0]][1] += 1 75 n_auths += 1 76 auth_data = Data(subtitle=plural("login", n_auths) + " from") 77 if (len(sigma_auths) == 1): # if only one user, do not display no of logins for this user 78 auth_data.subtitle += ' ' + sigma_auths[0][0] 79 section.append_data(auth_data) 80 else: # multiple users 81 auth_data.items = sigma_auths 82 auth_data.orderbyfreq() 83 auth_data.truncl(config.prefs.getint("logparse", "maxlist")) 84 logger.debug("Found {0} samba logins".format(str(n_auths))) 85 section.append_data(auth_data) 86 logger.info("Finished smbd section") 87 return section