3
'j @ sh d dl Z d dlZd dlZd dlmZmZmZmZ G dd deZG dd deeZ G dd deeZ
dS ) N)Plugin PluginOptIndependentPlugin CosPluginc @ s( e Zd ZdZdZd Zdd Zdd Zd
S ) LogsBasez System logslogssystemhardwarestoragec sJ d}d|g}g } j |r t j|ddd}|j }xtjd|tjtjB dD ]}yP|d }|jd rt j
|j d
j d }|r|t
j
|7 }n|t
j
|7 }W qT tk
r } z jd | W Y d d } ~ X qTX qTW x0|j D ]$}
|
jd
r|t
j
|
j d
7 }qW W d Q R X x>|D ]6} j j|s<q" j|} | jd| 7 }q"W x<|D ]4} | jdr~| d
d } j| rb j| qbW jddddddddddddg jd jdd d d t fd d d0D }
|
rF jd#rF jd$d%gd&d' jd(d)d* jd+d,d* jd-rF jd.d/g d S )1Nz/etc/rsyslog.confz/etc/syslog.confrzUTF-8)encodingz-(include\((\s*)?file=([\"'`]([^'\"]*)[\"'`])))patternstringflags zecho z $`zError parsing include(): z$IncludeConfigz^\S+\s+(-?\/.*$)\s+-z/var/log/auth.log*z/var/log/boot.logz/var/log/dist-upgradez/var/log/installerz/var/log/kern.log*z/var/log/messages*z/var/log/secure*z/var/log/syslog*z
/var/log/udevz/etc/rsyslog.dzjournalctl --disk-usagez/var/logTs) recursiveZ
extra_optsc 3 s | ]} j j|d V qdS )z log/journal/N) path_exists path_join).0p)self /usr/lib/python3.6/logs.py V s z!LogsBase.setup../var/runzsystemd-journaldZ journal_fullZ journal_alld )tagsZprioritythisZjournal_since_boot)Zbootr ZlastZjournal_last_bootall_logsz/var/log/journal/*z/run/log/journal/*)r r )r openr readrefindallIM
startswithosgetenvsplitstripglob ExceptionZ
_log_debug
splitlinesZdo_regex_find_allZ path_isfileZ
add_copy_specadd_cmd_outputZadd_dir_listinganyZ
is_service add_journal
get_option)r ZrsyslogZconfsr ZconfZcontentmatchZ_entZenvcerrlineconfigiZjournalr )r r setup st
&
$
zLogsBase.setupc C s | j ddd d S )Nz
/etc/rsyslog*z (ActionLibdbiPassword |pwd=)(.*)z \1[********])Zdo_path_regex_sub)r r r r postprocc s zLogsBase.postprocN)r r r
)__name__
__module__ __qualname__Z
short_desc plugin_nameprofilesr: r; r r r r r s
Mr c @ s e Zd ZdZdZdZdS )IndependentLogsa
This plugin will collect logs traditionally considered to be "system" logs,
meaning those such as /var/log/messages, rsyslog, and journals that are
not limited to unit-specific entries.
Note that the --since option will apply to journal collections by this
plugin as well as the typical application to log files. Most users can
expect typical journal collections to include the "full" journal, as well
as journals limited to this boot and the previous boot.
r r r r
N)r r r
)r< r= r> __doc__r? r@ r r r r rA k s
rA c s, e Zd ZeddddgZ fddZ ZS )CosLogszlog-daysr z"the number of days logs to collect)namedefaultZdescc sD t j | jdr | jd n | jdd}| jd| dd d S )Nr" zjournalctl -o exportzlog-daysr r days)Zsince)superr: r4 r1 r3 )r rF ) __class__r r r: s
z
CosLogs.setup)r< r= r> r Z option_listr:
__classcell__r r )rH r rC { s
rC ) r. r* r% Zsos.report.pluginsr r r r r rA rC r r r r s \