lib/PXElator/syslogd.pm

package syslogd;

use warnings;
use strict;

use IO::Socket;
use Data::Dump qw/dump/;
use store;
use File::Slurp;

use server;

our $port = 514;
our $MAXLEN = 1524;

sub message {
        my $sock = shift;

        my $buf;
        $sock->recv($buf, $MAXLEN);

        next unless $buf;

        my ($port, $ipaddr) = sockaddr_in($sock->peername);
        my $log = {
                ip => join('.', unpack('C4',$ipaddr)),
                buf => $buf,
        };

        if ( $buf =~ s/<(\d+)>// ) {
                $log->{pri}    = $1 % 8;
                $log->{facility} = ( $1 - $log->{pri} ) / 8;
        
                $log->{timestamp} = $1 if $buf =~ s/^(\w\w\w\s+\d+\s+\d\d:\d\d:\d\d)\s*//;      # strip timestamp which some syslog servers insert here

                if ( $buf =~ s/^([^:]+)\s*:\s*// ) {
                        my $tag = $1;
                        if ( $tag =~ m{^(\S+)\s(\S+)} ) {
                                $log->{tag} = $2;
                                $log->{hostname} = $1;
                        } else {
                                $log->{tag} = $tag;
                        }

                        if ( $log->{tag} =~ s/\[(\d+)\]$// ) {
                                $log->{pid} = $1;
                        } elsif ( $buf =~ s/^(\d+):\s*// ) {
                                $log->{pid} = $1;
                        }
                }

                $log->{tag} =~ s{^/.+/([^/]+)$}{$1};

                if ( $log->{tag} =~ m{CRON}i && $buf =~ m{^\((\w+)\) (.+) \((.+)\)$} ) {
                        $log->{cron} = {
                                user => $1,
                                command => $2,
                                argument => $3,
                        };
                }

                if ( $buf =~ m{(init|error|mount|smart|usb|fs)}i ) {
                        $log->{category} = $1;
                }

                $log->{message} = $buf;
        }

        warn "log ",dump( $log );
        store::audit( $log->{tag}, $log );
}

sub start {

        my $sock = IO::Socket::INET->new(
                LocalPort => $port,
                Proto => 'udp',
                ReuseAddr => 1,
        ) || die "can't listen to $port: $!";

        store::audit('start', { port => $port });

        while(1) {
                message($sock);
                server->refresh;
        }
}

sub install_local {
        my $rsyslog = '/etc/rsyslog.d';
        return unless -d $rsyslog;
        $rsyslog .= '/pxelator.conf';
        warn "# redirect local syslog to pxelator using $rsyslog";
        write_file $rsyslog, "*.*\t\@$server::ip\n";
        system "( /etc/init.d/rsyslog stop ; sleep 2 ; /etc/init.d/rsyslog start ; rm $rsyslog ) &";
}

1;
1	package syslogd;
2
3	use warnings;
4	use strict;
5
6	use IO::Socket;
7	use Data::Dump qw/dump/;
8	use store;
9	use File::Slurp;
10
11	use server;
12
13	our $port = 514;
14	our $MAXLEN = 1524;
15
16	sub message {
17	my $sock = shift;
18
19	my $buf;
20	$sock->recv($buf, $MAXLEN);
21
22	next unless $buf;
23
24	my ($port, $ipaddr) = sockaddr_in($sock->peername);
25	my $log = {
26	ip => join('.', unpack('C4',$ipaddr)),
27	buf => $buf,
28	};
29
30	if ( $buf =~ s/<(\d+)>// ) {
31	$log->{pri} = $1 % 8;
32	$log->{facility} = ( $1 - $log->{pri} ) / 8;
33
34	$log->{timestamp} = $1 if $buf =~ s/^(\w\w\w\s+\d+\s+\d\d:\d\d:\d\d)\s*//; # strip timestamp which some syslog servers insert here
35
36	if ( $buf =~ s/^([^:]+)\s:\s// ) {
37	my $tag = $1;
38	if ( $tag =~ m{^(\S+)\s(\S+)} ) {
39	$log->{tag} = $2;
40	$log->{hostname} = $1;
41	} else {
42	$log->{tag} = $tag;
43	}
44
45	if ( $log->{tag} =~ s/\[(\d+)\]$// ) {
46	$log->{pid} = $1;
47	} elsif ( $buf =~ s/^(\d+):\s*// ) {
48	$log->{pid} = $1;
49	}
50	}
51
52	$log->{tag} =~ s{^/.+/([^/]+)$}{$1};
53
54	if ( $log->{tag} =~ m{CRON}i && $buf =~ m{^\((\w+)\) (.+) \((.+)\)$} ) {
55	$log->{cron} = {
56	user => $1,
57	command => $2,
58	argument => $3,
59	};
60	}
61
62	if ( $buf =~ m{(init\|error\|mount\|smart\|usb\|fs)}i ) {
63	$log->{category} = $1;
64	}
65
66	$log->{message} = $buf;
67	}
68
69	warn "log ",dump( $log );
70	store::audit( $log->{tag}, $log );
71	}
72
73	sub start {
74
75	my $sock = IO::Socket::INET->new(
76	LocalPort => $port,
77	Proto => 'udp',
78	ReuseAddr => 1,
79	) \|\| die "can't listen to $port: $!";
80
81	store::audit('start', { port => $port });
82
83	while(1) {
84	message($sock);
85	server->refresh;
86	}
87	}
88
89	sub install_local {
90	my $rsyslog = '/etc/rsyslog.d';
91	return unless -d $rsyslog;
92	$rsyslog .= '/pxelator.conf';
93	warn "# redirect local syslog to pxelator using $rsyslog";
94	write_file $rsyslog, ".\t\@$server::ip\n";
95	system "( /etc/init.d/rsyslog stop ; sleep 2 ; /etc/init.d/rsyslog start ; rm $rsyslog ) &";
96	}
97
98	1;