ADD and DEL operations now supported
This commit is contained in:
parent
aff1c5af75
commit
2cbac9a0c3
@ -43,10 +43,14 @@ const (
|
||||
UnbindRE = `(UNBIND)?`
|
||||
// group[40]
|
||||
ConnClosedRE = `(closed)?(?: \(connection lost\))?`
|
||||
// group[41]
|
||||
AddDnRE = `(?:ADD dn="(.*)")?`
|
||||
// group[42]
|
||||
DelDnRE = `(?:DEL dn="(.*)")?`
|
||||
|
||||
LogLineRE = SyslogPri + TimeRE + ` ` + HostRE + ` ` + ProcessRE + ` ` + ConnIdRE + ` ` + ConnFdRE + OperationIdRE + ` ` +
|
||||
AcceptRE + STARTTLSRE + BindMethodRE + BindMechRE + ResultRE + SearchBaseRE + SearchAttrRE + SearchResultRE + ModDnRE + ModAttrRE +
|
||||
PassModRE + UnbindRE + ConnClosedRE
|
||||
PassModRE + UnbindRE + ConnClosedRE + AddDnRE + DelDnRE
|
||||
)
|
||||
|
||||
type (
|
||||
@ -74,6 +78,8 @@ type (
|
||||
SSF string `json:"ssf"`
|
||||
ModDN string `json:"mod_dn"`
|
||||
ModAttr string `json:"mod_attr"`
|
||||
AddDN string `json:"add_dn"`
|
||||
DelDN string `json:"del_dn"`
|
||||
PassModDN string `json:"passmod_dn"`
|
||||
Result bool
|
||||
ResTag string `json:"result_tag"`
|
||||
@ -184,6 +190,8 @@ func (o *OpenldapLog) Parse(text []byte) (LogFormat, error) {
|
||||
ModDN: string(group[36]),
|
||||
ModAttr: string(group[37]),
|
||||
PassModDN: string(group[38]),
|
||||
AddDN: string(group[41]),
|
||||
DelDN: string(group[42]),
|
||||
}
|
||||
|
||||
// Now handle Operation Type
|
||||
@ -203,6 +211,10 @@ func (o *OpenldapLog) Parse(text []byte) (LogFormat, error) {
|
||||
logFormat.OpType = "unbind"
|
||||
} else if len(group[40]) > 0 {
|
||||
logFormat.OpType = "close"
|
||||
} else if len(group[41]) > 0 {
|
||||
logFormat.OpType = "add"
|
||||
} else if len(group[42]) > 0 {
|
||||
logFormat.OpType = "del"
|
||||
}
|
||||
|
||||
return logFormat, nil
|
||||
|
||||
@ -57,6 +57,8 @@ type (
|
||||
SSF string `json:"ssf,omitempty"`
|
||||
ModDN string `json:"mod_dn,omitempty"`
|
||||
ModAttr string `json:"mod_attr,omitempty"`
|
||||
AddDN string `json:"add_dn,omitempty"`
|
||||
DelDN string `json:"del_dn,omitempty"`
|
||||
PassModDN string `json:"passmod_dn,omitempty"`
|
||||
ResTag string `json:"result_tag,omitempty"`
|
||||
ResOid string `json:"result_oid,omitempty"`
|
||||
@ -100,6 +102,8 @@ type (
|
||||
StartTLS bool `json:"starttls,omitempty"`
|
||||
ModDN string `json:"mod_dn,omitempty"`
|
||||
ModAttr string `json:"mod_attr,omitempty"`
|
||||
AddDN string `json:"add_dn,omitempty"`
|
||||
DelDN string `json:"del_dn,omitempty"`
|
||||
PassModDN string `json:"passmod_dn,omitempty"`
|
||||
ResTag string `json:"result_tag,omitempty"`
|
||||
ResOid string `json:"result_oid,omitempty"`
|
||||
@ -125,7 +129,7 @@ var (
|
||||
File os.File
|
||||
Writer *bufio.Writer
|
||||
|
||||
Version = "0.6.10"
|
||||
Version = "0.6.11"
|
||||
|
||||
BuildInfo = promauto.NewGaugeVec(prometheus.GaugeOpts{
|
||||
Name: "openldaplogparser_build_info",
|
||||
@ -167,6 +171,14 @@ var (
|
||||
Name: "openldaplogparser_mod_count",
|
||||
Help: "Number of MOD commands executed",
|
||||
}, []string{"host"})
|
||||
AddCnt = promauto.NewCounterVec(prometheus.CounterOpts{
|
||||
Name: "openldaplogparser_add_count",
|
||||
Help: "Number of ADD commands executed",
|
||||
}, []string{"host"})
|
||||
DelCnt = promauto.NewCounterVec(prometheus.CounterOpts{
|
||||
Name: "openldaplogparser_del_count",
|
||||
Help: "Number of DEL commands executed",
|
||||
}, []string{"host"})
|
||||
PassModCnt = promauto.NewCounterVec(prometheus.CounterOpts{
|
||||
Name: "openldaplogparser_passmod_count",
|
||||
Help: "Number of PASSMOD commands executed",
|
||||
@ -273,6 +285,22 @@ func OlcToFlat(olc *OpenLdapConnection) []OpenLdapConnectionFlat {
|
||||
olcf[i].ResQTime = olc.Operations[i].ResQTime
|
||||
olcf[i].ResETime = olc.Operations[i].ResETime
|
||||
olcf[i].ResText = olc.Operations[i].ResText
|
||||
case "add":
|
||||
olcf[i].AddDN = olc.Operations[i].AddDN
|
||||
olcf[i].ResTag = olc.Operations[i].ResTag
|
||||
olcf[i].ResOid = olc.Operations[i].ResOid
|
||||
olcf[i].ResErr = olc.Operations[i].ResErr
|
||||
olcf[i].ResQTime = olc.Operations[i].ResQTime
|
||||
olcf[i].ResETime = olc.Operations[i].ResETime
|
||||
olcf[i].ResText = olc.Operations[i].ResText
|
||||
case "del":
|
||||
olcf[i].DelDN = olc.Operations[i].DelDN
|
||||
olcf[i].ResTag = olc.Operations[i].ResTag
|
||||
olcf[i].ResOid = olc.Operations[i].ResOid
|
||||
olcf[i].ResErr = olc.Operations[i].ResErr
|
||||
olcf[i].ResQTime = olc.Operations[i].ResQTime
|
||||
olcf[i].ResETime = olc.Operations[i].ResETime
|
||||
olcf[i].ResText = olc.Operations[i].ResText
|
||||
case "passmod":
|
||||
olcf[i].PassModDN = olc.Operations[i].PassModDN
|
||||
olcf[i].ResTag = olc.Operations[i].ResTag
|
||||
@ -736,6 +764,82 @@ func parseStoreAndWrite(input []byte, mq map[string]*OpenLdapConnection, mqMtx *
|
||||
return nil
|
||||
}
|
||||
|
||||
/*
|
||||
* 2022-07-18T14:35:17.381223+02:00 ldap.domain.org slapd slapd[82581] conn=16113 op=3 ADD dn="cn=coincoin,dc=domain,dc=org"
|
||||
*/
|
||||
if logFormat.AddDN != "" {
|
||||
op := &Operation{
|
||||
Time: logFormat.Time,
|
||||
OpType: logFormat.OpType,
|
||||
OpId: &logFormat.OpId,
|
||||
AddDN: logFormat.AddDN,
|
||||
}
|
||||
mqMtx.Lock()
|
||||
olc, ok := mq[fmt.Sprintf("%s:%d", logFormat.Hostname, logFormat.ConnId)]
|
||||
if false == ok {
|
||||
if false == gDispUnkConn {
|
||||
mqMtx.Unlock()
|
||||
return nil
|
||||
} else {
|
||||
// Create connection
|
||||
olc = &OpenLdapConnection{
|
||||
Time: logFormat.Time,
|
||||
Hostname: logFormat.Hostname,
|
||||
Process: logFormat.Process,
|
||||
ConnId: logFormat.ConnId,
|
||||
ConnFd: logFormat.ConnFd,
|
||||
ClientIp: logFormat.ClientIp,
|
||||
ClientPort: logFormat.ClientPort,
|
||||
ServerIp: logFormat.ServerIp,
|
||||
ServerPort: logFormat.ServerPort,
|
||||
}
|
||||
mq[fmt.Sprintf("%s:%d", logFormat.Hostname, logFormat.ConnId)] = olc
|
||||
}
|
||||
}
|
||||
olc.Operations = append(olc.Operations, op)
|
||||
mqMtx.Unlock()
|
||||
AddCnt.WithLabelValues(olc.Hostname).Inc()
|
||||
return nil
|
||||
}
|
||||
|
||||
/*
|
||||
* 2022-07-18T14:35:17.381223+02:00 ldap.domain.org slapd slapd[82581] conn=16113 op=3 DEL dn="cn=coincoin,dc=domain,dc=org"
|
||||
*/
|
||||
if logFormat.DelDN != "" {
|
||||
op := &Operation{
|
||||
Time: logFormat.Time,
|
||||
OpType: logFormat.OpType,
|
||||
OpId: &logFormat.OpId,
|
||||
DelDN: logFormat.DelDN,
|
||||
}
|
||||
mqMtx.Lock()
|
||||
olc, ok := mq[fmt.Sprintf("%s:%d", logFormat.Hostname, logFormat.ConnId)]
|
||||
if false == ok {
|
||||
if false == gDispUnkConn {
|
||||
mqMtx.Unlock()
|
||||
return nil
|
||||
} else {
|
||||
// Create connection
|
||||
olc = &OpenLdapConnection{
|
||||
Time: logFormat.Time,
|
||||
Hostname: logFormat.Hostname,
|
||||
Process: logFormat.Process,
|
||||
ConnId: logFormat.ConnId,
|
||||
ConnFd: logFormat.ConnFd,
|
||||
ClientIp: logFormat.ClientIp,
|
||||
ClientPort: logFormat.ClientPort,
|
||||
ServerIp: logFormat.ServerIp,
|
||||
ServerPort: logFormat.ServerPort,
|
||||
}
|
||||
mq[fmt.Sprintf("%s:%d", logFormat.Hostname, logFormat.ConnId)] = olc
|
||||
}
|
||||
}
|
||||
olc.Operations = append(olc.Operations, op)
|
||||
mqMtx.Unlock()
|
||||
DelCnt.WithLabelValues(olc.Hostname).Inc()
|
||||
return nil
|
||||
}
|
||||
|
||||
/*
|
||||
2022-07-18T11:13:17.521717+02:00 ldap.domain.org slapd[82581] conn=16113 op=4 PASSMOD id="cn=pika,ou=users,dc=domain,dc=org" new
|
||||
*/
|
||||
|
||||
Loading…
Reference in New Issue
Block a user