xp-dev.com Git - logcheck/blob - logcheck.pl

   1 #!/usr/bin/perl
   2
   3 #    Logchecker - perl script to check unix logfiles and notify by email
   4 #    if entries appear not covered by the whitelist
   5 #    Copyright (C) long time ago by Peter, peters-webcorner.de
   6 #
   7 #    This program is free software: you can redistribute it and/or modify
   8 #    it under the terms of the GNU General Public License as published by
   9 #    the Free Software Foundation, either version 3 of the License, or
  10 #    (at your option) any later version.
  11 #
  12 #    This program is distributed in the hope that it will be useful,
  13 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 #    GNU General Public License for more details.
  16 #
  17 #    You should have received a copy of the GNU General Public License
  18 #    along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19
  20 require 'logcheck.conf';
  21 $mode="run";
  22
  23
  24 sub head() {
  25         print "\n";
  26         print "-----------------------------\n";
  27         print "This is logcheck.pl V1.0.4\n";
  28         print "https://peters-webcorner.de\n";
  29         print "project hosted on github\n";
  30         print "https://github.com/pstimpel/logcheck\n\n";
  31         print "Logchecker - Copyright (C) long time ago by Peter\n";
  32     print "This program comes with ABSOLUTELY NO WARRANTY; for details run `-l'.\n";
  33     print "This is free software, and you are welcome to redistribute it\n";
  34     print "under certain conditions. Check license for details.\n";
  35         print "-----------------------------\n\n";
  36 }
  37
  38 if (($ARGV[0] ne "") && ($ARGV[0] ne "debug") && ($ARGV[0] ne "-l")) {
  39         head();
  40         print "Parameters:\n";
  41         print "logcheck.pl         normal run, parse logfiles and fire email if needed\n";
  42         print "logcheck.pl debug   prevents script from sending mail\n";
  43         print "logcheck.pl -l      prints license to console\n";
  44         exit 0;
  45
  46 }
  47
  48 if ($ARGV[0] eq "-l") {
  49         head();
  50         print "Content of license\n\n\n";
  51         system('cat LICENSE | more');
  52         exit 0;
  53 }
  54
  55 if ($ARGV[0] eq "debug") {
  56         head();
  57         print "debug mode on...\n";
  58         $mode="debug";
  59
  60 }
  61
  62 if (-e $file_whitelist) {
  63         if($mode eq "debug") {
  64                 print "whitelist found...\n";
  65         }
  66 }
  67 else
  68 {
  69         open(ADR, ">$file_whitelist");
  70         print ADR "";
  71         close(ADR);
  72         print "Please edit ".$file_whitelist." first...\n";
  73         exit 1;
  74
  75 }
  76 if (-e $file_logfilelist) {
  77         if($mode eq "debug") {
  78                 print "list of logfiles found...\n";
  79         }
  80 } else {
  81         open(ADR, ">$file_logfilelist");
  82         print ADR "";
  83         close(ADR);
  84         print "Please edit ".$file_logfilelist." first...\n";
  85         exit 1;
  86
  87 }
  88
  89
  90 $read=0;
  91 open(ADR, "<$file_whitelist");
  92 while(<ADR>)
  93 {
  94         chop($_);
  95         if(length($_) > 1) {
  96                 if (substr($_,0,1) ne "#")
  97                 {
  98                 $read++;
  99                 push @whitelisted, $_;
 100                 }
 101         }
 102 }
 103 close(ADR);
 104 if ($read > 0) {
 105         if($mode eq "debug") {
 106                 print $read." entries in whitelist found\n";
 107         }
 108 }
 109 else
 110 {
 111         if($mode eq "debug") {
 112                 print "no entries in whitelist found, may be not normal...\n";
 113         }
 114 }
 115
 116
 117
 118 $read=0;
 119 open(ADR, "<$file_logfilelist");
 120 while(<ADR>)
 121 {
 122         chop($_);
 123         if(length($_) > 1) {
 124                 if (substr($_,0,1) ne "#")
 125                 {
 126                 $read++;
 127                 push @logfiles, $_;
 128                 }
 129         }
 130 }
 131 close(ADR);
 132 if ($read > 0) {
 133         if($mode eq "debug") {
 134                 print $read." entries in logfile list found\n";
 135         }
 136 }
 137 else
 138 {
 139         print "there must be at least one entry in "..$file_logfilelist."\n";
 140         print "ABORTING NOW!!!\n";
 141         exit 1;
 142 }
 143
 144
 145 foreach $thisfile (@logfiles) {
 146         $outtext="";
 147         $noffset="";
 148         $offset;
 149         $jumpover;
 150         if($mode eq "debug") {
 151                 print "processing ".$thisfile."\n";
 152         }
 153         if(-e $thisfile)
 154         {
 155                 $useoffset=0;
 156                 $thisoffset="";
 157                 if(-e $thisfile.".offset") {
 158                         if($mode eq "debug") {
 159                                 print "using ".$thisfile.".offset\n";
 160                         }
 161                         $useoffset=1;
 162                         open(OFF,"<$thisfile.offset");
 163                         while(<OFF>)
 164                         {
 165                                 $offset=$_;
 166                                 if($mode eq "debug") {
 167                                         print "offset is $_\n";
 168                                 }
 169                         }
 170                         close(OFF);
 171                 }
 172                 $jumpover=1;
 173                 check();
 174                 if($jumpover==1) {
 175                         unlink($thisfile.".offset");
 176                         if($mode eq "debug") {
 177                                 print "offset not found, reparsing without offset\n";
 178                         }
 179                         $jumpover=0;
 180                         $offset="";
 181                         check();
 182                 }
 183                 if ($outtext ne "") {
 184                         if($mode eq "debug") {
 185                                 print "mail not sent, cause debug is enabled\n";
 186                                 print "content of mail to $emailaddress would be:\n---------------------------------\n";
 187                                 print $outtext;
 188                                 print "\n---------------------------------\nend of mail\n";
 189                         } else {
 190                                 $Jetztwert = time();
 191                                 $Jetztzeit = localtime($Jetztwert);
 192                                 $mailer = '/usr/sbin/sendmail';
 193                                 $Sender = $senderaddress;
 194                                 open(MAIL, "|$mailer -t") || die "Can't open $mailer!\n";
 195                                 print MAIL "To: ".$emailaddress."\n";
 196                                 print MAIL "Subject: ($thisfile) violation report $Jetztzeit\n\n\n";
 197                                 print MAIL $outtext;
 198                                 close(MAIL);
 199                                 $command="\/usr\/bin\/logger -p warn logcheckprint";
 200                 system($command);
 201                         }
 202                 } else {
 203                         if($mode eq "debug") {
 204                                 print "nothing to send, $thisfile seems to be ok\n";
 205                         }
 206                 }
 207                 if ($noffset ne "") {
 208                         if($mode eq "debug") {
 209                                 print "new offset written in ".$thisfile.".offset\n";
 210                         }
 211                         open(ADR, ">$thisfile.offset");
 212                                print ADR $noffset;
 213                         close(ADR);
 214                 }
 215         }
 216         else
 217         {
 218                 print STDERR "logfile $thisfile not found...ignoring\n";
 219         }
 220 }
 221 exit 0;
 222
 223
 224 sub check() {
 225         # checks the logfile itself
 226         open(LOG,"<$thisfile");
 227         while(<LOG>)
 228         {
 229                 if ($jumpover == 0) {
 230                         $wl=0;
 231                         foreach $wltext (@whitelisted)
 232                         {
 233                                 if($_ =~/$wltext/)
 234                                 {
 235                                         $wl=1;
 236                                 }
 237                         }
 238                         if($wl==0)
 239                         {
 240                                 $outtext=$outtext.$_;
 241                         }
 242                 }
 243                 $noffset = substr($_,0,15,);
 244                 if(substr($_,0,15) eq $offset) {
 245                         $jumpover=0;
 246                         if($mode eq "debug") {
 247                                 print "offset found\n";
 248                         }
 249                 }
 250         }
 251         close(LOG);
 252 }
 253
 254