class Fluent::Plugin::GoAuditParserFilter
Constants
- SYSCALLS
- TYPES
Public Instance Methods
filter_with_time(tag, time, record)
click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 558 def filter_with_time(tag, time, record) if record.key?('timestamp') timestamp = record.delete('timestamp').to_f time = Fluent::EventTime.from_time(Time.at(timestamp)) end if record.key?('messages') && record.key?('uid_map') messages = record.delete('messages') uid_map = record.delete('uid_map') new_messages = messages.each.with_object({}) do |message, new_messages| type, data = message.values_at('type', 'data') name = TYPES[type.to_i] hash = { 'type' => type.to_i } parseline(data).each do |key, val| case key when 'syscall' hash[key] = SYSCALLS[val.to_i] when 'msg' hash[key] = parseline(val) when 'saddr' hash[key] = sockaddr(val) when 'proctitle' hash[key] = packhex(val) when 'uid', 'euid', 'suid', 'ouid', 'fsuid', 'auid' hash[key] = uid(val, uid_map) when 'gid', 'egid', 'sgid', 'ogid', 'fsgid' hash[key] = val.to_i when 'exit', 'item', 'items', 'pid', 'ppid', 'ses', 'argc', 'inode' hash[key] = val.to_i else hash[key] = val end end name = "#{name}#{hash['item']}" if name == 'path' new_messages.update(name => hash) end record['messages'] = new_messages record['message_types'] = new_messages.keys end return time, record end
packhex(text)
click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 617 def packhex(text) [text].pack("H*").gsub(/[^[:print:]]/, ' ') end
parseline(text)
click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 605 def parseline(text) regex = /([^\s=]+)=('[^']*'|"[^"]*"|\S+)/ text.scan(regex).each.with_object({}) do |(key, val), hash| val = val[1..-2] if val.start_with?('\'') || val.start_with?('"') hash[key] = val end end
sockaddr(text)
click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 621 def sockaddr(text) addr = {} case text[0, 2].hex + (256 * text[2, 2].hex) when 1 pos = text.index('00', 4) - 4 pos = text.size - 4 if pos < 0 addr.update('family' => 'local') addr.update('path' => packhex(text[4, pos])) addr.update('unknown' => text[pos+4..-1]) if text.size > pos + 5 when 2 addr.update('family' => 'inet') addr.update('port' => (text[4, 2].hex * 256) + text[6, 2].hex) addr.update('ip' => text[8, 8].scan(/.{2}/).map{ |x| x.hex }.join(".")) addr.update('unknown' => text[16..-1]) if text.length > 16 when 10 addr.update('family' => 'inet6') addr.update('port' => (text[4, 2].hex * 256) + text[6, 2].hex) addr.update('flow_info' => text[8, 8]) addr.update('ip' => text[16, 32].scan(/.{4}/).map{ |x| x.downcase }.join(":")) addr.update('scope_id' => text[48, 8]) addr.update('unknown' => text[56..-1]) if text.size > 56 else addr.update('unknown' => text[4..-1]) end addr end
uid(id, uid_map)
click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 613 def uid(id, uid_map) { 'id' => id.to_i, 'name' => uid_map[id] } end