| # NOTE: These patterns take into account the additional log-line information passed to the logstash listener from rsyslog. YMMV. | |
| DHCPD ((%{SYSLOGTIMESTAMP:timestamp})\s*(%{HOSTNAME:hostname})\s*dhcpd\S+\s*(%{WORD:dhcp_action})?.*[for|on] (%{IPV4:dhcp_client_ip})?.*[from|to] (%{COMMONMAC:dhcp_client_mac})?.*via (%{USERNAME:interface})) | |
| IPTABLES ((%{SYSLOGTIMESTAMP:nf_timestamp})\s*(%{HOSTNAME:nf_host})\s*kernel\S+\s*(%{WORD:nf_action})?.*IN=(%{USERNAME:nf_in_interface})?.*OUT=(%{USERNAME:nf_out_interface})?.*MAC=(%{COMMONMAC:nf_dst_mac}):(%{COMMONMAC:nf_src_mac})?.*SRC=(%{IPV4:nf_src_ip}).*DST=(%{IPV4:nf_dst_ip}).*PROTO=(%{WORD:nf_protocol}).?*SPT=(%{INT:nf_src_port}?.*DPT=%{INT:nf_dst_port}?.*)) | |
| DNS ((%{MONTHDAY:day})-(%{MONTH:month})-(%{YEAR:year}) (%{TIME:timestamp}) client (%{IPV4:dns_client_ip})#(%{NONNEGINT:dns_uuid})?.*query: (%{HOSTNAME:dns_dest}) (%{WORD:dns_type}) (%{WORD:dns_record})?.*(%{IPV4:dns_server})) | |
| PGSQL ((%{SYSLOGTIMESTAMP:pgsql_timestamp}) (%{HOSTNAME:pgsql_hostname})?.*SAST >(%{WORD:pgs |
| #!/bin/bash | |
| # | |
| # Carries out a full mysqldump, calls percona-xtrabackup and then | |
| # copies the sql dump, the percona backup and your mysql bin logs | |
| # to S3 using s3cmd http://s3tools.org/s3cmd | |
| # | |
| # TODO: extract out the S3 backup stuff to make it optional, and so | |
| # other s3 programs can replace the s3cmd call. | |
| # TODO: the if [ $? == 0 ] alert blocks should be a function | |
| # TODO: make the if [ $? == 0 ] if [ $? != 0 ] more consistent - test |
| #!/bin/sh | |
| # | |
| # Startup Script for the LibreOffice server. Save it into /etc/init.d/libreoffice | |
| # and install it using `insserv /etc/init.d/libreoffice`. | |
| # | |
| # Copyright (C) 2012 Marcello Barnaba <vjt@openssl.it> | |
| # | |
| # LSB compatible service control script; see http://www.linuxbase.org/spec/ | |
| # | |
| ### BEGIN INIT INFO |
| AUDIT type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): user pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} subj=%{WORD:audit_subject} msg=%{GREEDYDATA:audit_message} | |
| AUDITLOGIN type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): login pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} old auid=%{NUMBER:old_auid} new auid=%{NUMBER:new_auid} old ses=%{NUMBER:old_ses} new ses=%{NUMBER:new_ses} |
| import bisect | |
| import itertools | |
| import operator | |
| class _BNode(object): | |
| __slots__ = ["tree", "contents", "children"] | |
| def __init__(self, tree, contents=None, children=None): | |
| self.tree = tree |
