Skip to content
Snippets Groups Projects
Commit 31705e58 authored by Pavel Eis's avatar Pavel Eis Committed by Pavel Kácha
Browse files

Suricata connector - fixed timestamp and logger setup moved before...

Suricata connector - fixed timestamp and logger setup moved before daemonization with added get_logger_files function for not closing logger file desriptors.
parent 75cc0702
Branches
No related tags found
No related merge requests found
...@@ -160,7 +160,7 @@ class IdeaGen(object): ...@@ -160,7 +160,7 @@ class IdeaGen(object):
'Anomaly.Application': re.compile("web application(?! Attack)")} 'Anomaly.Application': re.compile("web application(?! Attack)")}
vulnerability_re = re.compile("vulnerability|vulnerable") vulnerability_re = re.compile("vulnerability|vulnerable")
confidence_re = re.compile("(?i)(?:suspicious|possible|potential)") confidence_re = re.compile("(?i)(?:suspicious|most likely|possible|potential)")
confidence_likely_re = re.compile("(?i)most likely") confidence_likely_re = re.compile("(?i)most likely")
cve_list_file = open("CVE_list.txt") cve_list_file = open("CVE_list.txt")
...@@ -184,7 +184,7 @@ class IdeaGen(object): ...@@ -184,7 +184,7 @@ class IdeaGen(object):
event = { event = {
'Format': "IDEA0", 'Format': "IDEA0",
'ID': str(uuid4()), 'ID': str(uuid4()),
'DetectTime': timestamp, 'DetectTime': timestamp[0:19] + "Z",
'Category': [category] + (["Test"] if self.test else []), 'Category': [category] + (["Test"] if self.test else []),
'Note': incident_desription, 'Note': incident_desription,
} }
...@@ -233,6 +233,17 @@ class IdeaGen(object): ...@@ -233,6 +233,17 @@ class IdeaGen(object):
return event return event
def get_logger_files(logger):
""" Return file objects of loggers """
files = []
for handler in logger.handlers:
if hasattr(handler, 'stream') and hasattr(handler.stream, 'fileno'):
files.append(handler.stream)
if hasattr(handler, 'socket') and hasattr(handler.socket, 'fileno'):
files.append(handler.socket)
return files
def daemonize( def daemonize(
work_dir=None, chroot_dir=None, work_dir=None, chroot_dir=None,
umask=None, uid=None, gid=None, umask=None, uid=None, gid=None,
...@@ -399,6 +410,21 @@ def main(): ...@@ -399,6 +410,21 @@ def main():
optp.print_help() optp.print_help()
sys.exit() sys.exit()
log_format = "%(message)s"
logger = logging.getLogger()
if opts.oneshot:
handler = logging.StreamHandler()
handler.setFormatter(logging.Formatter("%(asctime)s - " + log_format))
else:
if "/" in opts.log:
handler = logging.handlers.WatchedFileHandler(opts.log)
handler.setFormatter(logging.Formatter("%(asctime)s - " + log_format))
else:
handler = logging.handlers.SysLogHandler(adress="/dev/log", facility=opts.log)
handler.setFormatter(logging.Formatter(log_format))
logger.addHandler(handler)
logger.setLevel(logging.DEBUG if opts.verbose else logging.INFO)
if opts.oneshot: if opts.oneshot:
signal.signal(signal.SIGINT, terminate_me) signal.signal(signal.SIGINT, terminate_me)
signal.signal(signal.SIGTERM, terminate_me) signal.signal(signal.SIGTERM, terminate_me)
...@@ -408,6 +434,7 @@ def main(): ...@@ -408,6 +434,7 @@ def main():
pidfile=opts.pid, pidfile=opts.pid,
uid=opts.uid, uid=opts.uid,
gid=opts.gid, gid=opts.gid,
files_preserve = get_logger_files(logger),
signals={ signals={
signal.SIGINT: terminate_me, signal.SIGINT: terminate_me,
signal.SIGTERM: terminate_me, signal.SIGTERM: terminate_me,
...@@ -417,21 +444,6 @@ def main(): ...@@ -417,21 +444,6 @@ def main():
filer = Filer(opts.dir) filer = Filer(opts.dir)
idea_gen = IdeaGen(opts.name, opts.test) idea_gen = IdeaGen(opts.name, opts.test)
log_format = "%(message)s"
logger = logging.getLogger()
if opts.oneshot:
handler = logging.StreamHandler()
handler.setFormatter(logging.Formatter("%(asctime)s - " + log_format))
else:
if "/" in opts.log:
handler = logging.handlers.WatchedFileHandler(opts.log)
handler.setFormatter(logging.Formatter("%(asctime)s - " + log_format))
else:
handler = logging.handlers.SysLogHandler(address="/dev/log", facility=opts.log)
handler.setFormatter(logging.Formatter(log_format))
logger.addHandler(handler)
logger.setLevel(logging.DEBUG if opts.verbose else logging.INFO)
while running_flag: while running_flag:
for log_file in files: for log_file in files:
while True: while True:
......
...@@ -51,7 +51,6 @@ def main(): ...@@ -51,7 +51,6 @@ def main():
if processed_rules_list: if processed_rules_list:
processed_rules_file.write("\n".join(sorted(processed_rules_list))) processed_rules_file.write("\n".join(sorted(processed_rules_list)))
processed_rules_file.write("\n") processed_rules_file.write("\n")
processed_rules_list = []
if __name__ == "__main__": if __name__ == "__main__":
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment