use Linux::Inotify2;
use Time::HiRes qw[ time sleep ];
+require Guardian::Base;
require Guardian::Config;
require Guardian::Parser;
require Guardian::Socket;
# Define version.
my $version ="2.0";
-# Array to store the monitored logfiles.
-my @monitored_files = (
- "/var/log/snort/alert",
-);
-
# Get and store the given command line arguments in a hash.
my %cmdargs = ();
# Push the may be given config file argument.
my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
+# Shared hash between the main process and all threads. It will store all
+# monitored files and their current file position.
+my %monitored_files :shared = ();
+
# Create the main queue. It is used to store and process all events which are
# reported and enqueued by the worker threads.
my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";;
# Setup IPC mechanism via Socket in an own thread.
threads->create(\&Socket);
+ # Generate hash of monitored files.
+ %monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);
+
# Start worker threads.
&StartWorkers();
}
# Signal handler to kill worker.
$SIG{'KILL'} = sub { threads->exit(); };
- # Get the fileposition.
- my $fileposition = &Init_fileposition("$file");
-
# Create inotify watcher.
my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n";
if ($watcher->read) {
my @message = ();
+ # Obtain fileposition from hash.
+ my $fileposition = $monitored_files{$file};
+
# Open the file.
open (FILE, $file) or die "Could not open $file. $!\n";
push (@message, $line);
}
- # Update fileposition.
- $fileposition = tell(FILE);
+ {
+ # Lock shared hash.
+ lock(%monitored_files);
+
+ # Update fileposition.
+ $monitored_files{$file} = tell(FILE);
+ }
# Close file.
close(FILE);
#
## Function to start the workers (threads) for all monitored files.
#
-## This function will loop through the array of monitored files and will
+## This function will loop through the hash of monitored files and will
## spawn an own thread based worker for each file. Every created worker will
## be added to the array of running workers.
#
sub StartWorkers () {
- # Loop through the array of which files should be monitored and
- # create a worker thread for each single one.
- foreach my $monitored_file (@monitored_files) {
- # Check if the file exists and is readable.
- if (-r "$monitored_file") {
- # Create worker thread for the file.
- push @running_workers, threads->create(\&Worker,$monitored_file);
- }
+ # Loop through the hash which contains the monitored files and start
+ # a worker thread for each single one.
+ foreach my $file (keys %monitored_files) {
+ # Create worker thread for the file.
+ push @running_workers, threads->create(\&Worker,$file);
}
}