lib/PXElator/syslogd.pm

package syslogd;

use warnings;
use strict;

use IO::Socket;
use Data::Dump qw/dump/;
use CouchDB;

use server;

our $port = 514;
our $MAXLEN = 1524;

sub message {
        my $sock = shift;

        my $buf;
        $sock->recv($buf, $MAXLEN);

        next unless $buf;

        my ($port, $ipaddr) = sockaddr_in($sock->peername);
        my $log = {
                ip => join('.', unpack('C4',$ipaddr)),
                buf => $buf,
        };

        if ( $buf =~ s/<(\d+)>// ) {
                $log->{pri}    = $1 % 8;
                $log->{facility} = ( $1 - $log->{pri} ) / 8;
        
                $log->{timestamp} = $1 if $buf =~ s/^(\w\w\w\s+\d+\s+\d\d:\d\d:\d\d)\s*//;      # strip timestamp which some syslog servers insert here

                if ( $buf =~ s/^([^:]+)\s*:\s*// ) {
                        my $tag = $1;
                        if ( $tag =~ m{^(\S+)\s(\S+)} ) {
                                $log->{tag} = $2;
                                $log->{hostname} = $1;
                        } else {
                                $log->{tag} = $tag;
                        }

                        if ( $log->{tag} =~ s/\[(\d+)\]$// ) {
                                $log->{pid} = $1;
                        } elsif ( $buf =~ s/^(\d+):\s*// ) {
                                $log->{pid} = $1;
                        }
                }

                if ( $log->{tag} =~ m{CRON}i && $buf =~ m{^\((\w+)\) (.+) \((.+)\)$} ) {
                        $log->{cron} = {
                                user => $1,
                                command => $2,
                                argument => $3,
                        };
                }

                if ( $buf =~ m{(init|error|mount|smart|usb|fs)}i ) {
                        $log->{category} = $1;
                }

                $log->{message} = $buf;
        }

        warn "log ",dump( $log );
        CouchDB::audit( 'syslog', $log );
}

sub start {

        my $sock = IO::Socket::INET->new(
                LocalPort => $port,
                Proto => 'udp',
                ReuseAddr => 1,
        ) || die "can't listen to $port: $!";

        CouchDB::audit('start', { port => $port });

        while(1) {
                message($sock);
                server->refresh;
        }
}

1;
1	dpavlin	230	package syslogd;
2
3			use warnings;
4			use strict;
5
6			use IO::Socket;
7			use Data::Dump qw/dump/;
8			use CouchDB;
9
10	dpavlin	238	use server;
11
12	dpavlin	230	our $port = 514;
13			our $MAXLEN = 1524;
14
15	dpavlin	239	sub message {
16			my $sock = shift;
17	dpavlin	230
18			my $buf;
19	dpavlin	239	$sock->recv($buf, $MAXLEN);
20	dpavlin	238
21	dpavlin	239	next unless $buf;
22	dpavlin	238
23	dpavlin	239	my ($port, $ipaddr) = sockaddr_in($sock->peername);
24			my $log = {
25			ip => join('.', unpack('C4',$ipaddr)),
26			buf => $buf,
27			};
28	dpavlin	230
29	dpavlin	239	if ( $buf =~ s/<(\d+)>// ) {
30			$log->{pri} = $1 % 8;
31			$log->{facility} = ( $1 - $log->{pri} ) / 8;
32
33			$log->{timestamp} = $1 if $buf =~ s/^(\w\w\w\s+\d+\s+\d\d:\d\d:\d\d)\s*//; # strip timestamp which some syslog servers insert here
34	dpavlin	230
35	dpavlin	239	if ( $buf =~ s/^([^:]+)\s:\s// ) {
36			my $tag = $1;
37			if ( $tag =~ m{^(\S+)\s(\S+)} ) {
38			$log->{tag} = $2;
39			$log->{hostname} = $1;
40			} else {
41			$log->{tag} = $tag;
42	dpavlin	238	}
43	dpavlin	230
44	dpavlin	239	if ( $log->{tag} =~ s/\[(\d+)\]$// ) {
45			$log->{pid} = $1;
46			} elsif ( $buf =~ s/^(\d+):\s*// ) {
47			$log->{pid} = $1;
48	dpavlin	238	}
49	dpavlin	239	}
50	dpavlin	238
51	dpavlin	239	if ( $log->{tag} =~ m{CRON}i && $buf =~ m{^\((\w+)\) (.+) \((.+)\)$} ) {
52			$log->{cron} = {
53			user => $1,
54			command => $2,
55			argument => $3,
56			};
57	dpavlin	230	}
58
59	dpavlin	247	if ( $buf =~ m{(init\|error\|mount\|smart\|usb\|fs)}i ) {
60			$log->{category} = $1;
61			}
62
63	dpavlin	239	$log->{message} = $buf;
64			}
65	dpavlin	238
66	dpavlin	239	warn "log ",dump( $log );
67			CouchDB::audit( 'syslog', $log );
68			}
69
70			sub start {
71
72			my $sock = IO::Socket::INET->new(
73			LocalPort => $port,
74			Proto => 'udp',
75			ReuseAddr => 1,
76			) \|\| die "can't listen to $port: $!";
77
78			CouchDB::audit('start', { port => $port });
79
80			while(1) {
81			message($sock);
82	dpavlin	238	server->refresh;
83	dpavlin	230	}
84			}
85
86			1;