logactio.git/LogActio/init.py, branch release

Migrate to Python 3

2020-07-30T15:03:42+00:00

Signed-off-by: David Sommerseth

Improve the message passing to the Reporter modules

2015-11-12T14:16:19+00:00

The message sent to the Reporter modules contained a string of
each regex match group values separated by a pipe (|).  This was
not flexible enough, so this change will send all the regex match
groups as a Python list to the Reporter.

The existing Reporter modules have currently just been modified
to stitch together the message list as a string identical to the
old behaviour now, to ensure backwards compatibility for now.

Signed-off-by: David Sommerseth

Update GPL license and other related details

2015-10-23T18:21:06+00:00

- Use the proper FSF address
- Use the new contact address for David Sommerseth
- Use a better wording for the GPLv2 only license

Signed-off-by: David Sommerseth

Fix off-by-one in hit counter

2015-09-25T19:40:18+00:00

Without this patch the "count" variable would be off by one when
passing it to the reporter modules.

Signed-off-by: David Sommerseth

Added a new threshold parameter: threshold-type

2013-12-26T16:41:34+00:00

This can be set to either 'rule' or 'exact'.  If not defined,
it defaults to 'rule' which is exactly the same as before.

In 'rule' mode, the threshould counter is increased each time
the regular expression triggers a match.

By switching to 'exact', it will be defined a threshold counter
based on the conntents of the regex groups when a match is found.
This gives a more fine grained threshold counter, which can be
used for example for blocking specific IP addresses after a
certain number of failed attempts is caught.

Signed-off-by: David Sommerseth

Added a simple logfile reopen mechanism

2012-11-15T01:27:24+00:00

If logrotate has been run inbetween since last time the log file
was checked, the opened fd will not point at the new file.  In this
case reopen the log file and process all new events in this new file.

Signed-off-by: David Sommerseth

Added 'reset-rule-rate-limits' variable to [Rules:*] sections

2012-09-28T02:08:38+00:00

This variable takes a comma separated list of rule names, for the
same log file, which will reset the any active processing
limitations.  This can make one rule enforce another rule to
become active again if 'rate-limit' or 'time-frame' limitations
for that rule is stopping it from reacting.

A useful scenario for this feature is if there is a rule which only
reports about connection issues f.ex. only once an hour.  If the
connection comes back again another rule can report about this
instantly.  Without this feature enabled, it can take up to one
hour before the report about the newly broken connection is sent.
By enabling this feature, the "connection OK" rule can reset the
rate-limit and/or time-frame restrictions on the "broken connection"
rule and thus force a report instantly if the connection breaks
again - regardless of the rate-limit/time-frame limitation.

Signed-off-by: David Sommerseth

Added a rate-limit variable to [Rule:*] sections

2012-09-20T23:28:33+00:00

This will avoid sending more reports if it happens within the
given amount of seconds since the last report for this rule.

So if you have this set to 10 seconds and this rule matches
a log line every second, the time between each report will be
10 seconds.  The rate-limit is kind of defining 1 report per
X seconds.

Signed-off-by: David Sommerseth

Added support for time-frame variable in [Rule:* sections]

2012-09-20T23:16:23+00:00

This optional variable extends the threshold trigger to require
the matching rule to have a hit within the given time-frame.

If threshold is set to 3 and time-frame to 10, it must be
3 events within 10 seconds for this rule to cause an action.

Signed-off-by: David Sommerseth

Added support for multiple reporters per [Logfile:] and [Rule:]

2012-09-16T15:26:13+00:00

This allows multiple reporters to act when it is triggered

Signed-off-by: David Sommerseth

logactio.git/LogActio/__init__.py, branch release