Compare commits

..

No commits in common. "bcacc8b6644b8b84c3f91bb70f1896d68ffde4a8" and "a25c788832d4f545c411a3a92086cfffaf009a2a" have entirely different histories.

4 changed files with 861 additions and 731 deletions

1451
Cargo.lock generated

File diff suppressed because it is too large Load diff

View file

@ -2,15 +2,20 @@
name = "log2db"
version = "0.1.0"
authors = ["Yannik"]
edition = "2021"
edition = "2018"
[dependencies]
structopt = "*"
tokio = {version="*", features=["rt", "macros"]}
tokio-util = {version="*", features=["codec"]}
tokio-postgres = {version = "*", features =["with-chrono-0_4"]}
tokio = "0.2.0-alpha.6"
chrono = "*"
futures-util = "*"
[dependencies.tokio-postgres]
git = "https://github.com/sfackler/rust-postgres.git"
features = ["with-chrono-0_4"]
[dependencies.futures-preview]
version = "=0.3.0-alpha.19"
features = [ "async-await" ]
[profile.release]
lto = "fat"

View file

@ -1,4 +0,0 @@
nimmt syslog von antennen und tuts in postgress.
für weniger glibc-versionsabhängingkeit bauen mit:
cargo build --release --target=x86_64-unknown-linux-musl

View file

@ -1,8 +1,9 @@
use std::str::FromStr;
use tokio_postgres::{Client, Config, NoTls, Statement};
use tokio_postgres::{Config, NoTls, Client, Statement};
use tokio::net::{TcpListener, TcpStream};
use tokio::prelude::*;
use std::net::SocketAddr;
use std::sync::Arc;
@ -11,11 +12,9 @@ use structopt::StructOpt;
use std::collections::HashSet;
use futures_util::FutureExt;
use futures_util::StreamExt;
type Error = Box<dyn std::error::Error>;
/// This application recieves logfiles in ubiquitis weird logfile format from the network,
/// splits each line into its fields and writes them to a sql database for further analysis.
///
@ -24,20 +23,21 @@ type Error = Box<dyn std::error::Error>;
#[derive(StructOpt)]
struct Options {
/// ip and (TCP) port to bind to
#[structopt(short, long, default_value = "[::]:514")]
addr: String,
#[structopt(short, long, default_value="[::]:514")]
addr : String,
/// space separated list of daemon/service names to not write to the db
#[structopt(default_value = "dnsmasq-dhcp")]
blacklist: Vec<String>,
#[structopt(default_value="dnsmasq-dhcp")]
blacklist: Vec<String>
}
#[tokio::main(flavor = "current_thread")]
#[tokio::main]
async fn main() -> Result<(), Error> {
let options = Options::from_args();
let postgresurl = std::env::var("LOG2DB_PSQL")
.map_err(|_| "please supply the LOG2DB_PSQL environment variable, containting a postgress connection string")?;
let mut cfg = Config::from_str(&postgresurl)?;
cfg.application_name("log2db");
let (client, connection) = cfg.connect(NoTls).await?;
@ -49,9 +49,7 @@ async fn main() -> Result<(), Error> {
});
tokio::spawn(connection);
client
.execute(
"create table if not exists log(
client.execute("create table if not exists log(
prio smallint,
rcv_ip inet,
rcv_date timestamptz,
@ -59,61 +57,43 @@ async fn main() -> Result<(), Error> {
daemon varchar,
message varchar
)
",
&[],
)
.await?;
", &[]).await?;
let client = Arc::new(client);
let insert_statement = client
.prepare("insert into log(prio, rcv_ip, rcv_date, date, daemon, message) values ($1, $2, $3, $4, $5, $6)").await?;
let listener = TcpListener::bind(&options.addr)
.await
let mut listener = TcpListener::bind(&options.addr).await
.map_err(|e| format!("could not bind to {} with error {:?}", &options.addr, e))?;
let blacklist: HashSet<_> = options.blacklist.into_iter().collect();
let blacklist = Arc::new(blacklist);
loop {
match listener.accept().await {
Ok((socket, peer)) => {
tokio::spawn(handle_peer_and_error(
socket,
peer,
client.clone(),
insert_statement.clone(),
blacklist.clone(),
));
}
tokio::spawn(
handle_peer_and_error(socket, peer, client.clone(), insert_statement.clone(), blacklist.clone())
);
},
Err(e) => eprintln!("{:?}", e),
}
}
}
use chrono::{DateTime, FixedOffset, Local};
use chrono::{Local, DateTime, FixedOffset};
async fn handle_peer_and_error(
stream: TcpStream,
peer: SocketAddr,
db: Arc<Client>,
insert_statement: Statement,
blacklist: Arc<HashSet<String>>,
) {
async fn handle_peer_and_error(stream: TcpStream, peer: SocketAddr, db: Arc<Client>, insert_statement: Statement, blacklist: Arc<HashSet<String>>) {
if let Err(e) = handle_peer(stream, peer, db, insert_statement, blacklist).await {
eprintln!("{}", e);
}
}
async fn handle_peer(
stream: TcpStream,
peer: SocketAddr,
db: Arc<Client>,
insert_statement: Statement,
blacklist: Arc<HashSet<String>>,
) -> Result<(), Error> {
use tokio_util::codec::{FramedRead, LinesCodec};
async fn handle_peer(stream: TcpStream, peer: SocketAddr, db: Arc<Client>, insert_statement: Statement, blacklist: Arc<HashSet<String>>)
-> Result<(), Error> {
use tokio::codec::{FramedRead, LinesCodec};
let ip = peer.ip();
@ -123,13 +103,9 @@ async fn handle_peer(
Some(line) => {
let (prio, now, date, service, log) = parse_line(&line)?;
if !blacklist.contains(service) {
db.execute(
&insert_statement,
&[&prio, &ip, &now, &date, &service, &log],
)
.await?;
}
db.execute(&insert_statement, &[&prio, &ip, &now, &date, &service, &log]).await?;
}
},
None => break,
}
}
@ -144,30 +120,15 @@ async fn handle_peer(
* , log entry
* )
*/
fn parse_line(
line: &'_ str,
) -> Result<
(
i16,
DateTime<Local>,
DateTime<FixedOffset>,
&'_ str,
&'_ str,
),
Error,
> {
fn parse_line(line: &'_ str) -> Result<(i16, DateTime<Local>, DateTime<FixedOffset>, &'_ str, &'_ str), Error> {
let mut prio_and_remainder = line.splitn(2, '>');
let prio = prio_and_remainder
.next()
.ok_or("log did not contain priority")?;
let prio = prio_and_remainder.next().ok_or("log did not contain priority")?;
let prio = &prio[1..];
let prio = prio
.parse()
.map_err(|e| format!("could not parse priority {}: {}", prio, e))?;
let prio = prio.parse()
.map_err(|e| format!("could not parse priority {}: {}",prio, e))?;
let line = prio_and_remainder
.next()
.expect("splitn should always return a second part");
let line = prio_and_remainder.next().expect("splitn should always return a second part");
let (date, line) = line.split_at(16);
// we need to prepend the current year and timezone, as that is not stated in the logfile
@ -175,17 +136,14 @@ fn parse_line(
let mut base = format!("{}", now.format("%Y %z "));
base.push_str(date);
let date = DateTime::parse_from_str(&base, "%Y %z %b %e %H:%M:%S ")
.map_err(|e| format!("could not parse {}{} {}", date, line, e))?;
let date = DateTime::parse_from_str(&base, "%Y %z %b %e %H:%M:%S ").
map_err(|e| format!("could not parse {}{} {}", date, line, e))?;
let mut parts = line.splitn(2, ':');
let service_and_pid = parts.next().ok_or("could not parse service")?;
let mut service_parts = service_and_pid.splitn(2, '[');
let service = service_parts
.next()
.ok_or("could not split pid from service")?
.trim();
let service = service_parts.next().ok_or("could not split pid from service")?.trim();
let log = parts.next().ok_or("could not parse logfile")?.trim();
Ok((prio, now, date, service, log))