| 1 |
|
#!/usr/bin/perl -w |
| 2 |
|
|
| 3 |
+ |
# |
| 4 |
+ |
# i-scream central monitoring system |
| 5 |
+ |
# http://www.i-scream.org.uk |
| 6 |
+ |
# Copyright (C) 2000-2002 i-scream |
| 7 |
+ |
# |
| 8 |
+ |
# This program is free software; you can redistribute it and/or |
| 9 |
+ |
# modify it under the terms of the GNU General Public License |
| 10 |
+ |
# as published by the Free Software Foundation; either version 2 |
| 11 |
+ |
# of the License, or (at your option) any later version. |
| 12 |
+ |
# |
| 13 |
+ |
# This program is distributed in the hope that it will be useful, |
| 14 |
+ |
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 |
+ |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 16 |
+ |
# GNU General Public License for more details. |
| 17 |
+ |
# |
| 18 |
+ |
# You should have received a copy of the GNU General Public License |
| 19 |
+ |
# along with this program; if not, write to the Free Software |
| 20 |
+ |
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
| 21 |
+ |
# |
| 22 |
+ |
|
| 23 |
|
# ----------------------------------------------------------- |
| 24 |
|
# Perl i-scream Host. |
| 25 |
|
# http://www.i-scream.org.uk |
| 53 |
|
$fqdn |
| 54 |
|
$pidfile |
| 55 |
|
$retry_wait |
| 56 |
+ |
$ostype |
| 57 |
+ |
$key |
| 58 |
|
@data |
| 59 |
|
); |
| 60 |
|
|
| 68 |
|
$seq_no = 1; |
| 69 |
|
$retry_wait = 60; |
| 70 |
|
|
| 71 |
+ |
# work out our platform, if we can. |
| 72 |
+ |
$ostype = `uname -s`; |
| 73 |
+ |
chomp $ostype; |
| 74 |
+ |
$ostype = "unknown" if not defined $ostype; |
| 75 |
+ |
|
| 76 |
|
# write our PID to a file |
| 77 |
|
# use home dir by default |
| 78 |
|
#$pidfile = $ENV{"HOME"}; |
| 82 |
|
&write_pid(); |
| 83 |
|
|
| 84 |
|
&tcp_configure(); |
| 85 |
+ |
&send_tcp_heartbeat(); |
| 86 |
|
&send_udp_packet(); |
| 87 |
|
|
| 88 |
|
$last_udp_time = time; |
| 162 |
|
|
| 163 |
|
print $sock "LASTMODIFIED\n"; |
| 164 |
|
$response = <$sock>; |
| 165 |
< |
if (!$response) { |
| 166 |
< |
print "The i-scream server did not return anything for the LASTMODIFIED command.\n"; |
| 165 |
> |
if (!$response || $response eq "ERROR\n") { |
| 166 |
> |
print "The i-scream server did not provide the LASTMODIFIED value.\n"; |
| 167 |
|
close($sock); |
| 168 |
|
wait_then_retry(); |
| 169 |
|
next; |
| 170 |
|
} |
| 171 |
< |
chop $response; |
| 171 |
> |
chomp $response; |
| 172 |
|
$last_modified = $response; |
| 173 |
|
|
| 174 |
|
print "Config last modified: ". (scalar localtime $last_modified/1000) . "\n"; |
| 175 |
|
|
| 176 |
|
print $sock "FILELIST\n"; |
| 177 |
|
$response = <$sock>; |
| 178 |
< |
if (!$response) { |
| 178 |
> |
if (!$response || $response eq "ERROR\n") { |
| 179 |
|
print "The i-scream server did not provide a configuration file list.\n"; |
| 180 |
|
close($sock); |
| 181 |
|
wait_then_retry(); |
| 182 |
|
next; |
| 183 |
|
} |
| 184 |
< |
chop $response; |
| 184 |
> |
chomp $response; |
| 185 |
|
$file_list = $response; |
| 186 |
|
|
| 187 |
|
print "File list obtained: $file_list\n"; |
| 188 |
|
|
| 189 |
|
print $sock "FQDN\n"; |
| 190 |
|
$response = <$sock>; |
| 191 |
< |
if (!$response) { |
| 191 |
> |
if (!$response || $response eq "ERROR\n") { |
| 192 |
|
print "The i-scream server did not tell us our FQDN.\n"; |
| 193 |
|
close($sock); |
| 194 |
|
wait_then_retry(); |
| 195 |
|
next; |
| 196 |
|
} |
| 197 |
< |
chop $response; |
| 197 |
> |
chomp $response; |
| 198 |
|
$fqdn = $response; |
| 199 |
|
|
| 200 |
|
print "FQDN returned: $fqdn\n"; |
| 201 |
|
|
| 202 |
|
print $sock "UDPUpdateTime\n"; |
| 203 |
|
$response = <$sock>; |
| 204 |
< |
if (!$response) { |
| 204 |
> |
if (!$response || $response eq "ERROR\n") { |
| 205 |
|
print "The i-scream server did not give us a UDPUpdateTime.\n"; |
| 206 |
|
close($sock); |
| 207 |
|
wait_then_retry(); |
| 208 |
|
next; |
| 209 |
|
} |
| 210 |
< |
chop $response; |
| 210 |
> |
chomp $response; |
| 211 |
|
$udp_update_time = $response; |
| 212 |
|
|
| 213 |
|
print $sock "TCPUpdateTime\n"; |
| 214 |
|
$response = <$sock>; |
| 215 |
< |
if (!$response) { |
| 215 |
> |
if (!$response || $response eq "ERROR\n") { |
| 216 |
|
print "The i-scream server did not give us a TCPUpdateTime.\n"; |
| 217 |
|
close($sock); |
| 218 |
|
wait_then_retry(); |
| 219 |
|
next; |
| 220 |
|
} |
| 221 |
< |
chop $response; |
| 221 |
> |
chomp $response; |
| 222 |
|
$tcp_update_time = $response; |
| 223 |
|
|
| 224 |
|
print "UDP packet period: $udp_update_time seconds.\nTCP heartbeat period: $tcp_update_time seconds.\n"; |
| 242 |
|
wait_then_retry(); |
| 243 |
|
next; |
| 244 |
|
} |
| 245 |
< |
chop $response; |
| 218 |
< |
$response =~ /^(.*);(.*);(.*)/; |
| 245 |
> |
chomp $response; |
| 246 |
|
if ($response eq "ERROR") { |
| 247 |
|
print "There are no active configured filters for your host.\n"; |
| 248 |
|
close($sock); |
| 249 |
|
wait_then_retry(); |
| 250 |
|
next; |
| 251 |
|
} |
| 252 |
+ |
$response =~ /^(.*);(.*);(.*)/; |
| 253 |
|
($filter_addr, $udp_port, $tcp_port) = ($1, $2, $3); |
| 254 |
|
unless (defined($filter_addr) && defined($udp_port) && defined($tcp_port)) { |
| 255 |
|
print "Failed: Filter address response from server did not make sense: $response\n"; |
| 294 |
|
opendir PLUGINS, $plugins_dir; |
| 295 |
|
my(@plugins) = readdir PLUGINS; |
| 296 |
|
foreach my $plugin (@plugins) { |
| 297 |
< |
push @data, `$plugins_dir/$plugin` if -x "$plugins_dir/$plugin" && -f "$plugins_dir/$plugin"; |
| 297 |
> |
push @data, `$plugins_dir/$plugin $ostype` if -x "$plugins_dir/$plugin" && -f "$plugins_dir/$plugin"; |
| 298 |
|
} |
| 299 |
|
|
| 300 |
|
# get some extra data |
| 308 |
|
push(@data, "packet.attributes.date $date"); |
| 309 |
|
push(@data, "packet.attributes.type data"); |
| 310 |
|
push(@data, "packet.attributes.ip $ip"); |
| 311 |
+ |
push(@data, "packet.attributes.key $key"); |
| 312 |
|
|
| 313 |
|
# sort the data |
| 314 |
|
@data = sort(grep(!/^$/, grep(/^packet\./, @data))); |
| 397 |
|
return; |
| 398 |
|
} |
| 399 |
|
|
| 400 |
+ |
print $sock "KEY\n"; |
| 401 |
+ |
$key = <$sock>; |
| 402 |
+ |
|
| 403 |
|
print $sock "ENDHEARTBEAT\n"; |
| 404 |
|
$response = <$sock>; |
| 405 |
|
if (!$response eq "OK\n") { |
| 455 |
|
$xmltemp .= &make_xml("$curlevel$curtag", $curline); |
| 456 |
|
} |
| 457 |
|
my($nextline) = $data[0]; chomp $nextline if defined $nextline; |
| 458 |
< |
if((defined $nextline) && ($nextline =~ /^$curlevel$curtag/)) { |
| 458 |
> |
$curtag =~ s/(.*)\./$1/; |
| 459 |
> |
if((defined $nextline) && ($nextline =~ /^$curlevel$curtag\./)) { |
| 460 |
|
$curline = ""; |
| 461 |
|
} |
| 462 |
|
else { |
| 430 |
– |
$curtag =~ s/(.*)\./$1/; |
| 463 |
|
$xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq ""; |
| 464 |
|
return $xmltemp; |
| 465 |
|
} |
| 477 |
|
return $xmltemp; |
| 478 |
|
} |
| 479 |
|
} |
| 480 |
+ |
# dealing with a null value |
| 481 |
+ |
elsif($curline =~ /^$curlevel([^\.\s]+)$/) { |
| 482 |
+ |
# simply adding a space makes the above elsif deal with it :) |
| 483 |
+ |
# just level with an empty tag in the XML |
| 484 |
+ |
$curline .= " "; |
| 485 |
+ |
} |
| 486 |
+ |
# failing all that, skip the line |
| 487 |
+ |
else { |
| 488 |
+ |
$curline = ""; |
| 489 |
+ |
} |
| 490 |
|
} |
| 491 |
|
} |
