]>
git.ipfire.org Git - people/stevee/guardian.git/blob - modules/Parser.pm
1 package Guardian
::Parser
;
5 use Exporter
qw(import);
7 our @EXPORT_OK = qw(IsSupportedParser Parser);
9 # This hash contains all supported parsers and which function
10 # has to be called to parse messages in the right way.
11 my %logfile_parsers = (
12 "snort" => \
&message_parser_snort
,
16 ## The main parsing function.
18 ## It is used to determine which sub-parser has to be used to
19 ## parse the given message in the right way and to return if
20 ## any action should be performed.
23 my ($parser, @message) = @_;
25 # If no responsible message parser could be found, just return nothing.
26 unless (exists($logfile_parsers{$parser})) {
30 # Call responsible message parser.
31 my $action = $logfile_parsers{$parser}->(@message);
33 # In case an action has been returned, return it too.
34 if (defined($action)) {
35 # Return which action should be performed.
36 return "count $action";
39 # Return undef, no action required.
44 ## IsSupportedParser function.
46 ## This very tiny function checks if a given parser name is available and
47 ## therefore a supported parser.
49 ## To perform these check, the function is going to lookup if a key in the
50 ## hash of supported parsers is available
52 sub IsSupportedParser
($) {
55 # Check if a key for the given parser exists in the hash of logfile_parsers.
56 if(exists($logfile_parsers{$parser})) {
57 # Found a valid parser, so return nothing.
61 # Return "False" if we got here, and therefore no parser
67 ## The Snort message parser.
69 ## This subfunction is responsible for parsing sort alerts and determine if
70 ## an action should be performed.
72 sub message_parser_snort
($) {
76 # Currently this parser just returns a simple message.
77 return "$message[0] SNORT A simple Snort Message";