| 5 |  | # http://www.i-scream.org.uk | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 6 |  | # | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 7 |  | # An all-in-one script to act as an i-scream host on | 
 
 
 
 
 
 
 
 
 
 
 | 8 | < | # a typical Unix/Linux box.  You may adapt the data-gathering | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 9 | < | # methods as you see fit. | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 10 | < | #  - pjm2@ukc.ac.uk | 
 
 
 
 
 
 
 
 
 | 8 | > | # a typical Unix/Linux box. | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 9 |  | # | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 10 |  | # $Author$ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 11 |  | # $Id$ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 33 |  | $fqdn | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 34 |  | $pidfile | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 35 |  | $retry_wait | 
 
 
 
 
 
 
 
 | 36 | + | @data | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 37 |  | ); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 38 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 39 |  | if (@ARGV != 2) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 44 |  | $filter_manager_port = $ARGV[1]; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 45 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 46 |  | $seq_no = 1; | 
 
 
 
 
 
 
 
 
 
 
 | 47 | < | $retry_wait = 600; | 
 
 
 
 
 
 
 
 
 | 47 | > | $retry_wait = 60; | 
 
 
 
 
 
 
 
 
 
 
 | 48 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 49 |  | # write our PID to a file | 
 
 
 
 
 
 
 
 
 
 
 | 50 | < | $pidfile = "/var/tmp/ihost.pid"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 50 | > | # use home dir by default | 
 
 
 
 
 | 51 | > | #$pidfile = $ENV{"HOME"}; | 
 
 
 
 
 | 52 | > | # or drop it in /var/tmp if we can't find HOME | 
 
 
 
 
 | 53 | > | $pidfile = "/var/tmp" if not defined $pidfile; | 
 
 
 
 
 | 54 | > | $pidfile .= "/.ihost.pid"; | 
 
 
 
 
 
 
 
 
 
 
 | 55 |  | &write_pid(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 56 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 57 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 78 |  | else { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 79 |  | $delay = $next_tcp; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 80 |  | } | 
 
 
 
 
 
 
 
 
 
 
 | 81 | < | `sleep $delay`; | 
 
 
 
 
 
 
 
 
 | 81 | > | sleep $delay; | 
 
 
 
 
 
 
 
 
 
 
 | 82 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 83 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 84 |  | # we'll probably never get here... | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 93 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 94 |  | sub wait_then_retry() { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 95 |  | print "Will retry configuration with filter manager in $retry_wait seconds.\n"; | 
 
 
 
 
 
 
 
 
 
 
 | 96 | < | `sleep $retry_wait`; | 
 
 
 
 
 
 
 
 
 | 96 | > | sleep $retry_wait; | 
 
 
 
 
 
 
 
 
 
 
 | 97 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 98 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 99 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 123 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 124 |  | print $sock "STARTCONFIG\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 125 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 126 | < | if (!chop $response eq "OK") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 127 | < | print "The i-scream server rejected the STARTCONFIG command.  Terminated."; | 
 
 
 
 
 
 
 
 
 | 126 | > | if ($response && !($response eq "OK\n")) { | 
 
 
 
 
 | 127 | > | print "The i-scream server rejected the STARTCONFIG command.\n"; | 
 
 
 
 
 
 
 
 
 
 
 | 128 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 129 |  | wait_then_retry(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 130 |  | next; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 134 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 135 |  | print $sock "LASTMODIFIED\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 136 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 | 137 | + | if (!$response) { | 
 
 
 
 
 
 
 
 | 138 | + | print "The i-scream server did not return anything for the LASTMODIFIED command.\n"; | 
 
 
 
 
 
 
 
 | 139 | + | close($sock); | 
 
 
 
 
 
 
 
 | 140 | + | wait_then_retry(); | 
 
 
 
 
 
 
 
 | 141 | + | next; | 
 
 
 
 
 
 
 
 | 142 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 143 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 144 |  | $last_modified = $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 145 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 147 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 148 |  | print $sock "FILELIST\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 149 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 | 150 | + | if (!$response) { | 
 
 
 
 
 
 
 
 | 151 | + | print "The i-scream server did not provide a configuration file list.\n"; | 
 
 
 
 
 
 
 
 | 152 | + | close($sock); | 
 
 
 
 
 
 
 
 | 153 | + | wait_then_retry(); | 
 
 
 
 
 
 
 
 | 154 | + | next; | 
 
 
 
 
 
 
 
 | 155 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 156 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 157 |  | $file_list = $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 158 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 160 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 161 |  | print $sock "FQDN\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 162 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 | 163 | + | if (!$response) { | 
 
 
 
 
 
 
 
 | 164 | + | print "The i-scream server did not tell us our FQDN.\n"; | 
 
 
 
 
 
 
 
 | 165 | + | close($sock); | 
 
 
 
 
 
 
 
 | 166 | + | wait_then_retry(); | 
 
 
 
 
 
 
 
 | 167 | + | next; | 
 
 
 
 
 
 
 
 | 168 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 169 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 170 |  | $fqdn = $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 171 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 173 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 174 |  | print $sock "UDPUpdateTime\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 175 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 | 176 | + | if (!$response) { | 
 
 
 
 
 
 
 
 | 177 | + | print "The i-scream server did not give us a UDPUpdateTime.\n"; | 
 
 
 
 
 
 
 
 | 178 | + | close($sock); | 
 
 
 
 
 
 
 
 | 179 | + | wait_then_retry(); | 
 
 
 
 
 
 
 
 | 180 | + | next; | 
 
 
 
 
 
 
 
 | 181 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 182 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 183 |  | $udp_update_time = $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 184 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 185 |  | print $sock "TCPUpdateTime\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 186 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 | 187 | + | if (!$response) { | 
 
 
 
 
 
 
 
 | 188 | + | print "The i-scream server did not give us a TCPUpdateTime.\n"; | 
 
 
 
 
 
 
 
 | 189 | + | close($sock); | 
 
 
 
 
 
 
 
 | 190 | + | wait_then_retry(); | 
 
 
 
 
 
 
 
 | 191 | + | next; | 
 
 
 
 
 
 
 
 | 192 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 193 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 194 |  | $tcp_update_time = $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 195 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 197 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 198 |  | print $sock "ENDCONFIG\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 199 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 200 | < | chomp $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 168 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 200 | > | if ($response && !($response eq "OK\n")) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 201 |  | print "ENDCONFIG command to server failed.  Terminated.\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 202 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 203 |  | wait_then_retry(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 208 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 209 |  | print $sock "FILTER\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 210 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 211 | < | unless (defined($response)) { | 
 
 
 
 
 
 
 
 
 | 211 | > | if (!$response) { | 
 
 
 
 
 
 
 
 
 
 
 | 212 |  | print "Failed: Could not get a filter address from the filter manager.\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 213 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 214 |  | wait_then_retry(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 215 |  | next; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 216 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 217 |  | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 | 218 | < | $response =~ /(.*);(.*);(.*)/; | 
 
 
 
 
 
 
 
 
 | 218 | > | $response =~ /^(.*);(.*);(.*)/; | 
 
 
 
 
 
 
 
 
 
 
 | 219 |  | if ($response eq "ERROR") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 220 |  | print "There are no active configured filters for your host.\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 221 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 234 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 235 |  | print $sock "END\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 236 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 237 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 206 | < | if ($response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 237 | > | if ($response && ($response eq "OK\n")) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 238 |  | print "Host successfully configured via TCP.\n" | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 239 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 240 |  | else { | 
 
 
 
 
 
 
 
 
 
 
 | 241 | < | print "The server failed the host configuration on the END command."; | 
 
 
 
 
 
 
 
 
 | 241 | > | print "The server failed the host configuration on the END command.\n"; | 
 
 
 
 
 
 
 
 
 
 
 | 242 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 243 |  | wait_then_retry(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 244 |  | next; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 253 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 254 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 255 |  |  | 
 
 
 
 
 
 
 
 
 | 225 | – |  | 
 
 
 
 
 
 
 
 
 | 226 | – |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 256 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 257 |  | # send_udp_packet | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 258 |  | # Sends a UDP packet to an i-scream filter. | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 261 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 262 |  | sub send_udp_packet() { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 263 |  |  | 
 
 
 
 
 
 
 
 
 
 
 | 264 | < | my(@statgrab) = `./statgrab.pl`; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 265 | < | my(%packet); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 266 | < | for (my($i) = 0; $i <= $#statgrab; $i++) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 267 | < | $statgrab[$i] =~ /^([^\s]*) (.*)$/; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 268 | < | $packet{$1} = $2; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 264 | > | my($plugins_dir) = "plugins"; | 
 
 
 
 
 | 265 | > |  | 
 
 
 
 
 | 266 | > | opendir PLUGINS, $plugins_dir; | 
 
 
 
 
 | 267 | > | my(@plugins) = readdir PLUGINS; | 
 
 
 
 
 | 268 | > | foreach my $plugin (@plugins) { | 
 
 
 
 
 | 269 | > | push @data, `$plugins_dir/$plugin` if -x "$plugins_dir/$plugin" && -f "$plugins_dir/$plugin"; | 
 
 
 
 
 
 
 
 
 
 
 | 270 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 271 |  |  | 
 
 
 
 
 
 
 
 | 272 | + | # get some extra data | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 273 |  | my($date) = time; | 
 
 
 
 
 
 
 
 | 274 | + | my($ip); | 
 
 
 
 
 
 
 
 | 275 | + | $ip = inet_ntoa(scalar(gethostbyname(hostname())) || 'localhost') or $ip = 'localhost'; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 276 |  |  | 
 
 
 
 
 
 
 
 
 
 
 | 277 | < | my($disk_info) = "<disk>"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 278 | < | my($i) = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 279 | < | while (defined $packet{"packet.disk.p$i.attributes.mount"}) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 280 | < | $disk_info .= "<p$i"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 281 | < | $disk_info .= " name=\"" . $packet{"packet.disk.p$i.attributes.name"} . "\""; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 282 | < | $disk_info .= " kbytes=\"" . $packet{"packet.disk.p$i.attributes.kbytes"} . "\""; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 250 | < | $disk_info .= " used=\"" . $packet{"packet.disk.p$i.attributes.used"} . "\""; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 251 | < | $disk_info .= " avail=\"" . $packet{"packet.disk.p$i.attributes.avail"} . "\""; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 252 | < | $disk_info .= " mount=\"" . $packet{"packet.disk.p$i.attributes.mount"} . "\""; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 253 | < | $disk_info .= "></p$i>"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 254 | < | ++$i; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 255 | < | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 256 | < | $disk_info .= "</disk>"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 257 | < |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 258 | < | my($ip) = inet_ntoa(scalar(gethostbyname(hostname())) || 'localhost'); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 259 | < |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 260 | < | # Build the XML packet this way, as we can clearly | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 261 | < | # see the structure and contents... I like this ;-) | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 262 | < | # [Note that the server rejects UDP packets that are | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 263 | < | # larger than 8196 bytes] | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 264 | < | my($xml) = <<EOF; | 
 
 
 
 
 
 
 
 
 | 277 | > | # add some extra data to the array | 
 
 
 
 
 | 278 | > | push(@data, "packet.attributes.seq_no=$seq_no"); | 
 
 
 
 
 | 279 | > | push(@data, "packet.attributes.machine_name=$fqdn"); | 
 
 
 
 
 | 280 | > | push(@data, "packet.attributes.date=$date"); | 
 
 
 
 
 | 281 | > | push(@data, "packet.attributes.type=data"); | 
 
 
 
 
 | 282 | > | push(@data, "packet.attributes.ip=$ip"); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 283 |  |  | 
 
 
 
 
 
 
 
 
 
 
 | 284 | < | <packet seq_no="$seq_no" machine_name="$fqdn" date="$date" type="data" ip="$ip"> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 285 | < | <load> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 286 | < | <load1>$packet{"packet.load.load1"}</load1> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 287 | < | <load5>$packet{"packet.load.load5"}</load5> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 288 | < | <load15>$packet{"packet.load.load15"}</load15> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 289 | < | </load> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 272 | < | <os> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 273 | < | <name>$packet{"packet.os.name"}</name> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 274 | < | <release>$packet{"packet.os.release"}</release> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 275 | < | <platform>$packet{"packet.os.platform"}</platform> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 276 | < | <sysname>$packet{"packet.os.sysname"}</sysname> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 277 | < | <version>$packet{"packet.os.version"}</version> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 278 | < | <uptime>$packet{"packet.os.uptime"}</uptime> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 279 | < | </os> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 280 | < | <users> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 281 | < | <count>$packet{"packet.users.count"}</count> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 282 | < | <list>$packet{"packet.users.list"}</list> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 283 | < | </users> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 284 | < | <processes> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 285 | < | <total>$packet{"packet.processes.total"}</total> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 286 | < | <sleeping>$packet{"packet.processes.sleeping"}</sleeping> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 287 | < | <zombie>$packet{"packet.processes.zombie"}</zombie> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 288 | < | <stopped>$packet{"packet.processes.stopped"}</stopped> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 289 | < | <cpu>$packet{"packet.processes.cpu"}</cpu> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 290 | < | </processes> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 291 | < | <cpu> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 292 | < | <idle>$packet{"packet.cpu.idle"}</idle> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 293 | < | <user>$packet{"packet.cpu.user"}</user> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 294 | < | <kernel>$packet{"packet.cpu.kernel"}</kernel> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 295 | < | <iowait>$packet{"packet.cpu.iowait"}</iowait> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 296 | < | <swap>$packet{"packet.cpu.swap"}</swap> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 297 | < | </cpu> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 298 | < | <memory> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 299 | < | <total>$packet{"packet.memory.total"}</total> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 300 | < | <free>$packet{"packet.memory.free"}</free> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 301 | < | </memory> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 302 | < | <swap> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 303 | < | <total>$packet{"packet.swap.total"}</total> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 304 | < | <free>$packet{"packet.swap.free"}</free> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 305 | < | </swap> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 306 | < | $disk_info | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 307 | < | </packet> | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 308 | < |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 309 | < | EOF | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 310 | < |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 311 | < | # Make the packet smaller by stripping out newlines and leading spaces. | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 312 | < | $xml =~ s/\n\s*//g; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 313 | < |  | 
 
 
 
 
 
 
 
 
 | 284 | > | # sort the data | 
 
 
 
 
 | 285 | > | @data = sort(@data); | 
 
 
 
 
 | 286 | > |  | 
 
 
 
 
 | 287 | > | # turn the array into some nice XML | 
 
 
 
 
 | 288 | > | my($xml) = &make_xml("", ""); | 
 
 
 
 
 | 289 | > |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 290 |  | my($sock) = new IO::Socket::INET ( | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 291 |  | PeerPort => $udp_port, | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 292 |  | PeerAddr => $filter_addr, | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 293 |  | Proto => 'udp' | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 294 |  | ) or die "Could not send UDP: $!\n"; | 
 
 
 
 
 
 
 
 
 
 
 | 295 | < |  | 
 
 
 
 
 
 
 
 
 | 295 | > |  | 
 
 
 
 
 
 
 
 
 
 
 | 296 |  | print $sock $xml or die "Could not send UDP packet: $!\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 297 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 298 |  | $seq_no++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 302 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 303 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 304 |  |  | 
 
 
 
 
 
 
 
 
 | 329 | – |  | 
 
 
 
 
 
 
 
 
 | 330 | – |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 305 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 306 |  | # send_tcp_heartbeat | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 307 |  | # Establishes a TCP connection to an i-scream filter. | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 308 |  | # The heartbeat is used as a guaranteed "I'm alive" delivery mechanism. | 
 
 
 
 
 
 
 
 | 309 | + | # If we need to reconfigure, then we complete the heartbeat before | 
 
 
 
 
 
 
 
 | 310 | + | # doing so. | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 311 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 312 |  | sub send_tcp_heartbeat() { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 313 |  |  | 
 
 
 
 
 
 
 
 | 314 | + | my ($doReconfigure) = 0; | 
 
 
 
 
 
 
 
 | 315 | + |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 316 |  | my($sock) = new IO::Socket::INET( | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 317 |  | PeerAddr => $filter_addr, | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 318 |  | PeerPort => $tcp_port, | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 329 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 330 |  | print $sock "HEARTBEAT\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 331 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 332 | < | return if (!defined $response); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 355 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 356 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 332 | > | if (!$response eq "OK\n") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 333 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 334 |  | print "Server gave wrong response to HEARTBEAT: $response\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 335 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 338 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 339 |  | print $sock "CONFIG\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 340 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 341 | < | return if (!defined $response); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 366 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 367 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 341 | > | if (!$response eq "OK\n") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 342 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 343 |  | print "Server gave wrong response to CONFIG: $response\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 344 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 347 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 348 |  | print $sock "$file_list\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 349 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 350 | < | return if (!defined $response); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 377 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 378 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 350 | > | if (!$response eq "OK\n") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 351 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 352 |  | print "Server gave wrong response to file list: $response\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 353 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 356 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 357 |  | print $sock "$last_modified\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 358 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 359 | < | return if (!defined $response); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 388 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 389 | < | if ($response eq "ERROR") { | 
 
 
 
 
 
 
 
 
 | 359 | > | if ($response eq "ERROR\n") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 360 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 361 |  | print "Server configuration changed.  Reconfiguring with filter manager.\n"; | 
 
 
 
 
 
 
 
 
 
 
 | 362 | < | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 393 | < | return; | 
 
 
 
 
 
 
 
 
 | 362 | > | $doReconfigure = 1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 363 |  | } | 
 
 
 
 
 
 
 
 
 
 
 | 364 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 364 | > | if (!$response eq "OK\n") { | 
 
 
 
 
 
 
 
 
 
 
 | 365 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 366 |  | print "Server gave wrong response to HEARTBEAT: $response\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 367 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 370 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 371 |  | print $sock "ENDHEARTBEAT\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 372 |  | $response = <$sock>; | 
 
 
 
 
 
 
 
 
 
 
 | 373 | < | return if (!defined $response); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 405 | < | chop $response; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 406 | < | if (!$response eq "OK") { | 
 
 
 
 
 
 
 
 
 | 373 | > | if (!$response eq "OK\n") { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 374 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 375 |  | print "Server gave wrong response to ENDHEARTBEAT: $response\n"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 376 |  | &tcp_configure(); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 380 |  | close($sock); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 381 |  | print "^"; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 382 |  |  | 
 
 
 
 
 
 
 
 | 383 | + | &tcp_configure() if $doReconfigure; | 
 
 
 
 
 
 
 
 | 384 | + |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 385 |  | return; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 386 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 387 |  |  | 
 
 
 
 
 
 
 
 | 388 | + |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 389 |  | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 390 |  | # write_pid | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 391 |  | # Writes the PID (process ID) of this instance to $pidfile. | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 397 |  | close PID; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 398 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 399 |  | return; | 
 
 
 
 
 
 
 
 | 400 | + | } | 
 
 
 
 
 
 
 
 | 401 | + |  | 
 
 
 
 
 
 
 
 | 402 | + | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 | 403 | + | # make_xml | 
 
 
 
 
 
 
 
 | 404 | + | # Turns an array of plugins data into an XML string. | 
 
 
 
 
 
 
 
 | 405 | + | #----------------------------------------------------------------------- | 
 
 
 
 
 
 
 
 | 406 | + | sub make_xml() { | 
 
 
 
 
 
 
 
 | 407 | + | my($curlevel, $curline) = @_; | 
 
 
 
 
 
 
 
 | 408 | + | my($xmltemp) = ""; my($curtag) = ""; my($attributes) = ""; | 
 
 
 
 
 
 
 
 | 409 | + | while(1) { | 
 
 
 
 
 
 
 
 | 410 | + | $curline = shift(@data) if $curline eq ""; chomp $curline; | 
 
 
 
 
 
 
 
 | 411 | + | if($curline =~ /^$curlevel([^\.\s]+\.)/) { | 
 
 
 
 
 
 
 
 | 412 | + | $curtag=$1; | 
 
 
 
 
 
 
 
 | 413 | + | } | 
 
 
 
 
 
 
 
 | 414 | + | if($curline =~ /^$curlevel$curtag([^\.\s]+)\s+(.*)$/) { | 
 
 
 
 
 
 
 
 | 415 | + | $xmltemp .= "<$1$attributes>$2</$1>"; | 
 
 
 
 
 
 
 
 | 416 | + | } | 
 
 
 
 
 
 
 
 | 417 | + | elsif($curline =~ /^$curlevel$curtag(attributes)\.([^\.=]+)=(.*)$/) { | 
 
 
 
 
 
 
 
 | 418 | + | $attributes .= " $2=\"$3\""; | 
 
 
 
 
 
 
 
 | 419 | + | } | 
 
 
 
 
 
 
 
 | 420 | + | else { | 
 
 
 
 
 
 
 
 | 421 | + | $xmltemp .= &make_xml("$curlevel$curtag", $curline); | 
 
 
 
 
 
 
 
 | 422 | + | } | 
 
 
 
 
 
 
 
 | 423 | + | my($nextline) = $data[0]; chomp $nextline if defined $nextline; | 
 
 
 
 
 
 
 
 | 424 | + | $curtag =~ s/(.*)\./$1/; | 
 
 
 
 
 
 
 
 | 425 | + | if((defined $nextline) && ($nextline =~ /^$curlevel$curtag\./)) { | 
 
 
 
 
 
 
 
 | 426 | + | $curline = ""; | 
 
 
 
 
 
 
 
 | 427 | + | } | 
 
 
 
 
 
 
 
 | 428 | + | else { | 
 
 
 
 
 
 
 
 | 429 | + | $xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq ""; | 
 
 
 
 
 
 
 
 | 430 | + | return $xmltemp; | 
 
 
 
 
 
 
 
 | 431 | + | } | 
 
 
 
 
 
 
 
 | 432 | + | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 433 |  | } |