Adjust Parser and Socket module outputs.
[people/stevee/guardian.git] / modules / Parser.pm
CommitLineData
88d9af2c
SS
1package Guardian::Parser;
2use strict;
3use warnings;
4
5use Exporter qw(import);
6
7our @EXPORT_OK = qw(Parser);
8
9# This hash contains all supported logfiles and which function
10# has to be called to parse them in the right way.
11my %logfile_parsers = (
12 "/var/log/snort/alert" => \&message_parser_snort,
13);
14
15#
16## The main parsing function.
17#
18## It is used to determine which sub-parser has to be used to
19## parse the given message in the right way and to return if
20## any action should be performed.
21#
22sub Parser ($$) {
23 my ($file, @message) = @_;
24
25 # If no responsible message parser could be found, just return nothing.
26 unless (exists($logfile_parsers{$file})) {
27 return;
28 }
29
30 # Call responsible logfile parser.
31 my $action = $logfile_parsers{$file}->(@message);
32
33 # Return which action should be performed.
ebd440a9 34 return "count $action";
88d9af2c
SS
35}
36
37#
38## The Snort message parser.
39#
40## This subfunction is responsible for parsing sort alerts and determine if
41## an action should be performed.
42#
43sub message_parser_snort($) {
44 my @message = @_;
45
46 # XXX
47 # Currently this parser just returns a simple message.
ebd440a9 48 return "$message[0] SNORT A simple Snort Message";
88d9af2c
SS
49}
50
511;