Initial checkin.

[people/stevee/guardian.git] / modules / Parser.pm

package Guardian::Parser;
use strict;
use warnings;

use Exporter qw(import);

our @EXPORT_OK = qw(Parser);

# This hash contains all supported logfiles and which function
# has to be called to parse them in the right way.
my %logfile_parsers = (
	"/var/log/snort/alert" => \&message_parser_snort,
);

#
## The main parsing function.
#
## It is used to determine which sub-parser has to be used to
## parse the given message in the right way and to return if
## any action should be performed.
#
sub Parser ($$) {
        my ($file, @message) = @_;

	# If no responsible message parser could be found, just return nothing.
	unless (exists($logfile_parsers{$file})) {
		return;
	}

	# Call responsible logfile parser.
	my $action = $logfile_parsers{$file}->(@message);

	# Return which action should be performed.
	return $action;
}

#
## The Snort message parser.
#
## This subfunction is responsible for parsing sort alerts and determine if
## an action should be performed.
#
sub message_parser_snort($) {
	my @message = @_;

	# XXX
	# Currently this parser just returns a simple message.
	return "snort_parser_return\n";
}

1;