]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/logs.cgi/log.dat
suricata: Change midstream policy to "pass-flow"
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / logs.cgi / log.dat
CommitLineData
cd1a2927
MT
1#!/usr/bin/perl
2#
3# SmoothWall CGIs
4#
5# This code is distributed under the terms of the GPL
6#
7# (c) The SmoothWall Team
8#
9# $Id: log.dat,v 1.6.2.22 2006/01/03 12:47:17 franck78 Exp $
10#
11
12use strict;
13
14# enable only the following on debugging purpose
5595bc03
CS
15use warnings;
16use CGI::Carp 'fatalsToBrowser';
cd1a2927 17
986e08d9 18require '/var/ipfire/general-functions.pl';
cd1a2927
MT
19require "${General::swroot}/lang.pl";
20require "${General::swroot}/header.pl";
21
f2fdd0c1
CS
22my %color = ();
23my %mainsettings = ();
24&General::readhash("${General::swroot}/main/settings", \%mainsettings);
8186b372 25&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
f2fdd0c1 26
cd1a2927
MT
27use POSIX();
28
cd1a2927
MT
29my %cgiparams=();
30my %logsettings=();
31my $errormessage = '';
32
33my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
34 'Sep', 'Oct', 'Nov', 'Dec' );
35my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'},
36 $Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'},
37 $Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'},
38 $Lang::tr{'december'} );
39
40my @now = localtime();
41my $dow = $now[6];
42my $doy = $now[7];
43my $tdoy = $now[7];
44my $year = $now[5]+1900;
45
46$cgiparams{'DAY'} = $now[3];
47$cgiparams{'MONTH'} = $now[4];
48$cgiparams{'ACTION'} = '';
97fe1741 49$cgiparams{'SECTION'} = 'ipfire';
cd1a2927
MT
50
51my %sections = (
284ebca0 52 'apcupsd' => '(apcupsd\[.*?\]: )',
5e818d6a 53 'auth' => '(\w+\(pam_unix\)\[.*\]: )',
a15c20fd 54 'wio' => '(wio:|wio\[.*\])',
6d31cfdd 55 'captive' => '(Captive:)',
4f57d698 56 'clamav' => '(clamd\[.*\]: |freshclam\[.*\]: )',
5362088b 57 'collectd' => '(collectd\[.*\]: )',
5595bc03 58 'cron' => '(fcron\[.*\]: )',
5e818d6a
MF
59 'ddns' => '(ddns\[\d+\]:)',
60 'dhcp' => '(dhcpd: )',
11121641 61 'dma' => '(dma: |dma\[.*\]: |postfix/\w*\[\d*\]: )',
5e818d6a 62 'guardian' => '(guardian\[.*\]: )',
452fd239 63 'haproxy' => '(haproxy\[.*?\]: )',
c0472dcf 64 'ipblocklist' => '(ipblocklist: )',
5e818d6a 65 'ipfire' => '(ipfire: )',
0e14ef8a 66 'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |charon: |vpnwatch: )',
5e818d6a 67 'kernel' => '(kernel: (?!DROP_))',
8f58e661 68 'monit' => '(monit\[.*?\]: )',
5e818d6a 69 'ntp' => '(ntpd(?:ate)?\[.*\]: )',
a15c20fd
AB
70 'nut' => '(upsmon\[.*?\]: )',
71 'oinkmaster' => '(oinkmaster\[.*\]: )',
0f0db884 72 'openvpn' => '(openvpnserver\[.*\]: |.*n2n\[.*\]: )',
5e818d6a
MF
73 'pakfire' => '(pakfire:)',
74 'red' => '(red:|pppd\[.*\]: |chat\[.*\]|pppoe\[.*\]|pptp\[.*\]|pppoa\[.*\]|pppoa3\[.*\]|pppoeci\[.*\]|ipppd|ipppd\[.*\]|kernel: ippp\d|kernel: isdn.*|ibod\[.*\]|dhcpcd\[.*\]|modem_run\[.*\])',
a15c20fd 75 'samba' => '(nmbd|smbd|winbind)\[\d+\]:',
830dfc97 76 'suricata' => '(suricata: )',
5e818d6a
MF
77 'squid' => '(squid\[.*\]: |squid: )',
78 'ssh' => '(sshd(?:\(.*\))?\[.*\]: )',
4bb38923 79 'unbound' => '(unbound: \[.*?\])(.*:.*$)',
5e818d6a 80 'urlfilter bl' => '(installpackage\[urlfilter\]: )',
957b6f92
RR
81 'wireless' => '(hostapd:|kernel: ath.*:|kernel: wifi[0-9]:)',
82 'zabbix_agentd' => '(zabbix_agentd\[.*?\]: )'
cd1a2927
MT
83 );
84
85# Translations for the %sections array.
86my %trsections = (
284ebca0 87 'apcupsd' => 'APCUPS',
5e818d6a 88 'auth' => "$Lang::tr{'loginlogout'}",
a15c20fd 89 'wio' => 'Who Is Online?',
e26a5c48 90 'captive' => $Lang::tr{'Captive'},
5e818d6a
MF
91 'clamav' => 'ClamAV',
92 'collectd' => 'Collectd',
93 'cron' => 'Cron',
9494c611 94 'ddns' => "$Lang::tr{'dynamic dns'}",
cd1a2927 95 'dhcp' => "$Lang::tr{'dhcp server'}",
5e818d6a 96 'dma' => 'Mail',
5e818d6a 97 'guardian' => "$Lang::tr{'guardian'}",
452fd239 98 'haproxy' => 'HAProxy',
c0472dcf 99 'ipblocklist' => "$Lang::tr{'ipblocklist'}",
5e818d6a 100 'ipfire' => 'IPFire',
cd1a2927 101 'ipsec' => 'IPSec',
5e818d6a 102 'kernel' => "$Lang::tr{'kernel'}",
0b2aa517 103 'monit' => 'Monit',
5e818d6a 104 'ntp' => 'NTP',
a15c20fd
AB
105 'nut' => 'NUT',
106 'oinkmaster' => 'Oinkmaster',
6e13d0a5 107 'openvpn' => 'OpenVPN',
c506cad0 108 'pakfire' => 'Pakfire',
5e818d6a 109 'red' => 'RED',
a15c20fd 110 'samba' => $Lang::tr{'samba'},
9f9651e0 111 'suricata' => "$Lang::tr{'intrusion detection'}",
5e818d6a
MF
112 'squid' => "$Lang::tr{'web proxy'}",
113 'ssh' => 'SSH',
d659de88 114 'unbound' => 'DNS: Unbound',
5e818d6a 115 'urlfilter bl' => 'URLFilter Blacklist',
957b6f92
RR
116 'wireless' => 'Wireless',
117 'zabbix_agentd' => 'Zabbix Agent'
cd1a2927
MT
118 );
119
120
121&Header::getcgihash(\%cgiparams);
122$logsettings{'LOGVIEW_REVERSE'} = 'off';
123&General::readhash("${General::swroot}/logging/settings", \%logsettings);
124${Header::viewsize} = defined ($logsettings{'LOGVIEW_VIEWSIZE'}) ? $logsettings{'LOGVIEW_VIEWSIZE'} : 150;
125
126my $start = ($logsettings{'LOGVIEW_REVERSE'} eq 'on') ? 0x7FFFF000 : 0; #index of firts line number to display
127
128if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'})
129{
130 my @temp = split(',',$ENV{'QUERY_STRING'});
131 $start = $temp[0];
132 $cgiparams{'MONTH'} = $temp[1];
133 $cgiparams{'DAY'} = $temp[2];
134 $cgiparams{'SECTION'} = $temp[3];
135}
136
137if (!($cgiparams{'MONTH'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) ||
138 !($cgiparams{'DAY'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)$/))
139{
140 $cgiparams{'DAY'} = $now[3];
141 $cgiparams{'MONTH'} = $now[4];
142}
143elsif($cgiparams{'ACTION'} eq '>>')
144{
145 my @temp_then=();
146 my @temp_now = localtime(time);
147 $temp_now[4] = $cgiparams{'MONTH'};
148 $temp_now[3] = $cgiparams{'DAY'};
149 if ($cgiparams{'DAY'}) {
150 @temp_then = localtime(POSIX::mktime(@temp_now) + 86400);
151 ## Retrieve the same time on the next day +
152 ## 86400 seconds in a day
153 } else {
154 $temp_now[3] = 1;
155 $temp_now[4] = ($temp_now[4]+1) %12;
156 @temp_then = localtime(POSIX::mktime(@temp_now) );
157 $temp_then[3] = 0;
158 }
159 $cgiparams{'MONTH'} = $temp_then[4];
160 $cgiparams{'DAY'} = $temp_then[3];
161}
162elsif($cgiparams{'ACTION'} eq '<<')
163{
164 my @temp_then=();
165 my @temp_now = localtime(time);
166 $temp_now[4] = $cgiparams{'MONTH'};
167 $temp_now[3] = $cgiparams{'DAY'};
168 if ($cgiparams{'DAY'}) {
169 @temp_then = localtime(POSIX::mktime(@temp_now) - 86400);
170 ## Retrieve the same time on the next day -
171 ## 86400 seconds in a day
172 } else {
173 $temp_now[3] = 1;
174 $temp_now[4] = ($temp_now[4]-1) %12;
175 @temp_then = localtime(POSIX::mktime(@temp_now) );
176 $temp_then[3] = 0;
177 }
178 $cgiparams{'MONTH'} = $temp_then[4];
179 $cgiparams{'DAY'} = $temp_then[3];
180}
181
182# Find in which file.gz is the log. Can be calculated because WEEKLY ROTATING of access.log
183my $gzindex;
184my $date = $cgiparams{'DAY'} == 0 ? '' : $cgiparams{'DAY'} <= 9 ? "0$cgiparams{'DAY'}" : "$cgiparams{'DAY'}";
185
186{
187 my $xday;
9f663e66 188
cd1a2927
MT
189 # Calculate time. If future date, calculate for past year !!!
190 if (( $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) ||
191 ( $cgiparams{'MONTH'} > $now[4] ) ) {
192 $xday = POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 );
193 $date = "$longmonths[$cgiparams{'MONTH'}] $date, ". int($year-1);
194 } else {
195 $xday = POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 );
196 $date = "$longmonths[$cgiparams{'MONTH'}] $date, $year";
197 }
198
199 # calculate end of active week (saturday 23H59)
200 my @then = ();
201 @then = localtime(time());
0d08de33 202 my $sunday = POSIX::mktime( 0, 0, 0, $then[3], $then[4], $then[5]);
cd1a2927
MT
203 $sunday += (6-$then[6]) * 86400;
204
205 # Convert delta in second to full weeks
206 $gzindex = int (($sunday-$xday)/604800 );
207}
9f663e66 208
cd1a2927
MT
209my $monthstr = $shortmonths[$cgiparams{'MONTH'}];
210my $daystr = $cgiparams{'DAY'} == 0 ? '..' : $cgiparams{'DAY'} <= 9 ? " $cgiparams{'DAY'}" : "$cgiparams{'DAY'}";
211my $section = $sections{$cgiparams{'SECTION'}};
212
213my $lines = 0;
214my @log=();
215
216my $loop = 1;
217my $filestr = 0;
218my $lastdatetime; # for debug
219my $search_for_end = 0;
9f663e66 220
cd1a2927
MT
221while ($gzindex >=0 && $loop) {
222 # calculate file name
223 if ($gzindex == 0) {
224 $filestr = "/var/log/messages";
1986cc88 225 $filestr = "/var/log/mail" if (${section} =~ 'dma');
cd1a2927
MT
226 } else {
227 $filestr = "/var/log/messages.$gzindex";
1986cc88 228 $filestr = "/var/log/mail.$gzindex" if (${section} =~ 'dma');
cd1a2927
MT
229 $filestr = "$filestr.gz" if -f "$filestr.gz";
230 }
231 # now read file if existing
232 if (open (FILE,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr))) {
233 #&General::log("reading $filestr");
234 READ:while (<FILE>) {
235 my $line = $_;
282e3fe4 236 if ($line =~ /^${monthstr} ${daystr} ..:..:.. [\w\-\.]+ ${section}(.*)/) {
5e818d6a 237 # when standard viewing, just keep in memory the correct slice
cd1a2927
MT
238 # it starts a '$start' and size is $viewport
239 # If export, then keep all lines...
240 if ($cgiparams{'ACTION'} eq $Lang::tr{'export'}){
241 $log[$lines++] = "$line";
242 } else {
243 if ($lines++ < ($start + $Header::viewsize)) {
244 push(@log,"$line");
245 if (@log > $Header::viewsize) {
246 shift (@log);
247 }
5e818d6a 248 #} else { don't do this optimisation, need to count lines !
cd1a2927
MT
249 # $datetime = $maxtime; # we have read viewsize lines, stop main loop
250 # last READ; # exit read file
251 }
252 }
253 $search_for_end = 1; # we find the start of slice, can look for end now
254 } else {
255 if ($search_for_end == 1) {
256 #finish read files when date is over (test month equality only)
257 $line =~ /^(...) (..) ..:..:..*$/;
258 $loop = 0 if ( ($1 ne $monthstr) || ( ($daystr ne '..') && ($daystr ne $2) ) );
259 }
260 }
261 }
262 close (FILE);
263 }
264 $gzindex--; # will try next gz file eg 40,39,38,.... because it may have holes when ipcop stopped
265 # for a long time
266}# while
267
268# $errormessage = "$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}";
269
270if ($cgiparams{'ACTION'} eq $Lang::tr{'export'})
271{
272 print "Content-type: text/plain\n\n";
78331e30 273 print "IPFire diagnostics\r\n";
cd1a2927
MT
274 print "$Lang::tr{'section'}: $cgiparams{'SECTION'}\n";
275 print "$Lang::tr{'date'}: $date\r\n\r\n";
276
277 if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; }
278
279 foreach $_ (@log)
280 {
282e3fe4 281 /^... (..) (..:..:..) [\w\-\.]+ ${section}(.*)$/;
cd1a2927
MT
282 my $day = $1;
283 $day =~ tr / /0/;
284 my $time = $cgiparams{'DAY'} ? "$2" : "$day/$2" ;
5595bc03 285 print "$time $3 $4\r\n";
cd1a2927
MT
286 }
287 exit 0;
288}
289
290&Header::showhttpheaders();
291
986e08d9 292&Header::openpage($Lang::tr{'system logs'}, 1, '');
cd1a2927
MT
293
294&Header::openbigbox('100%', 'left', '', $errormessage);
295
296if ($errormessage) {
297 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
298 print "<font class='base'>$errormessage&nbsp;</font>\n";
299 &Header::closebox();
300}
301
302&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:");
303
304print <<END
305<form method='post' action='$ENV{'SCRIPT_NAME'}'>
306<table width='100%'>
307<tr>
308 <td width='10%' class='base'>$Lang::tr{'section'}:&nbsp;</td>
309 <td width='20%'>
310 <select name='SECTION'>
311END
312;
5e818d6a 313foreach $section (sort {$trsections{$a} cmp $trsections{$b}} keys %sections) {
cd1a2927
MT
314 print "\t<option ";
315 if ($section eq $cgiparams{'SECTION'}) {
316 print "selected='selected' "; }
317 print "value='$section'>$trsections{$section}</option>\n";
318}
319print <<END
320 </select>
321 </td>
322 <td width='10%' class='base' align='right'>$Lang::tr{'month'}:&nbsp;</td>
323 <td width='10%'>
324 <select name='MONTH'>
325END
326;
327for (my $month = 0; $month < 12; $month++)
328{
329 print "\t<option ";
330 if ($month == $cgiparams{'MONTH'}) {
331 print "selected='selected' "; }
332 print "value='$month'>$longmonths[$month]</option>\n";
333}
334print <<END
335 </select>
336 </td>
337 <td width='10%' class='base' align='right'>&nbsp;$Lang::tr{'day'}:&nbsp;</td>
338 <td width='40%'>
339 <select name='DAY'>
340END
341;
342print "<option value='0'>$Lang::tr{'all'}</option>\n";
9f663e66 343for (my $day = 1; $day <= 31; $day++)
cd1a2927
MT
344{
345 print "\t<option ";
346 if ($day == $cgiparams{'DAY'}) {
347 print "selected='selected' "; }
348 print "value='$day'>$day</option>\n";
349}
350print <<END
351</select>
352</td>
353<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day before'}' value='&lt;&lt;' /></td>
354<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day after'}' value='&gt;&gt;' /></td>
355<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'update'}' /></td>
356<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'export'}' /></td>
357</tr>
358</table>
359</form>
360END
361;
362
363&Header::closebox();
364
365&Header::openbox('100%', 'left', $Lang::tr{'log'});
366print "<p><b>$Lang::tr{'total hits for log section'} $cgiparams{'SECTION'} $date: $lines</b></p>";
367
368$start = $lines - ${Header::viewsize} if ($start >= $lines - ${Header::viewsize});
369$start = 0 if ($start < 0);
370
371my $prev;
372 if ($start == 0) {
373 $prev = -1;
374 } else {
375 $prev = $start - ${Header::viewsize};
376 $prev = 0 if ( $prev < 0);
377 }
9f663e66 378
cd1a2927
MT
379my $next;
380 if ($start == $lines - ${Header::viewsize}) {
381 $next = -1;
382 } else {
383 $next = $start + ${Header::viewsize};
384 $next = $lines - ${Header::viewsize} if ($next >= $lines - ${Header::viewsize});
385 }
386
387if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; }
388if ($lines != 0) { &oldernewer(); }
389
390print <<END
fda1f52f 391<table width='100%' class='tbl'>
cd1a2927 392<tr>
fda1f52f 393 <th width='10%' align='center' class='boldbase'><b>$Lang::tr{'time'}</b></th>
5e818d6a
MF
394 <th width='15%' align='center' class='boldbase'><b>$Lang::tr{'section'}</b></th>
395 <th width='75%'>&nbsp;</th>
cd1a2927
MT
396</tr>
397END
398;
399
400$lines = 0;
401#print '<tt>';
402foreach $_ (@log)
403{
282e3fe4 404 /^... (..) (..:..:..) [\w\-\.]+ ${section}(.*)$/;
cd1a2927
MT
405 my $day = $1;
406 $day =~ tr / /0/;
407 my $time = $cgiparams{'DAY'} ? "$2" : "$day/$2" ;
408 my $sec = $3;
409 my $data = $4;
410 # correct the cut position, just when section=RED
411 if (($cgiparams{'SECTION'} eq 'red' ) && ($sec =~ /(kernel:)(.*)/)) {
412 $sec = 'kernel';
413 $data = $2.': '.$data;
414 }
415 my $d = substr ($data,0,80);
416 while (length($data)>80){ #very basic breaking of lines...
417 $data = substr ($data,80); #permit correct display in table cell
418 $d .= ' ' . substr ($data,0,80);
419 }
fda1f52f 420 my $col="";
cd1a2927
MT
421
422 if ($lines % 2) {
fda1f52f
AM
423 print "<tr>";
424 $col="bgcolor='$color{'color20'}'"; }
cd1a2927 425 else {
fda1f52f
AM
426 print "<tr>";
427 $col="bgcolor='$color{'color22'}'"; }
428 print "<td $col>$time<td $col>$sec<td $col>" .&Header::cleanhtml ("$d", 'y') . "</td></tr>\n";
cd1a2927
MT
429 $lines++;
430}
431#print '</tt>';
432print "</table>";
433
434&oldernewer();
435
436&Header::closebox();
437
438&Header::closebigbox();
439
440&Header::closepage();
441
442sub oldernewer
443{
444print <<END
445<table width='100%'>
446<tr>
447END
448;
449
450print "<td align='center' width='50%'>";
451if ($prev != -1) {
452 print "<a href='/cgi-bin/logs.cgi/log.dat?$prev,$cgiparams{'MONTH'},$cgiparams{'DAY'},$cgiparams{'SECTION'}'>$Lang::tr{'older'}</a>"; }
453else {
454 print "$Lang::tr{'older'}"; }
455print "</td>\n";
456
457print "<td align='center' width='50%'>";
458if ($next >= 0) {
459 print "<a href='/cgi-bin/logs.cgi/log.dat?$next,$cgiparams{'MONTH'},$cgiparams{'DAY'},$cgiparams{'SECTION'}'>$Lang::tr{'newer'}</a>"; }
460else {
461 print "$Lang::tr{'newer'}"; }
462print "</td>\n";
463
464print <<END
465</tr>
466</table>
467END
468;
469}