class Suricata::Logfile
This class opens a logfile, offers methods for reading logfiles and calls the logfile-parser
Attributes
@!attribute file
file-descriptor for logfile
@!attribute line
current line of the logfile. set by readline and readline_parse
@!attribute file
file-descriptor for logfile
@!attribute line
current line of the logfile. set by readline and readline_parse
@!attribute logfile
path and filename of the logfile
@!attribute parser
parser to use(default: Suricata::Fast)
@!attribute logfile
path and filename of the logfile
@!attribute parser
parser to use(default: Suricata::Fast)
Public Class Methods
constructor @param [String] logfile path and filename of the logfile @param [Boolean] autoopen calls open if true(default: true)
# File lib/suricata/logfile.rb, line 44 def initialize(logfile,autoopen=true,file=nil) @logfile = logfile @parser = Suricata::Fast.new if autoopen == true open else @file = file if not file.nil? end end
Public Instance Methods
this method closes the logfile
# File lib/suricata/logfile.rb, line 127 def close @file.close() end
this method opens the logfile and initialises file
# File lib/suricata/logfile.rb, line 122 def open @file = File.new(@logfile,"r") end
this method calls parser.parse(string) @param [String] string logfile-entry to parse @raise [Exception] “Invalid argument” if string is nil @raise [Exception] “Invalid parser” if parser is nil @return [Object] parser
# File lib/suricata/logfile.rb, line 60 def parse(string) if string.nil? raise "Invalid argument" end if @parser.nil? raise "Invalid parser" end @parser.parse(string) return @parser end
this method reads a line of the logfile
@example readline with a block
log = Suricata::Logfile.new("misc/fast.log") log.readline do |n| puts n end
@return [String] line current logfile entry @return [Boolean] false when EOF reached @yieldparam [String] @line current logfile entry
# File lib/suricata/logfile.rb, line 104 def readline begin if block_given? while @line = @file.readline yield(@line) end else @line = @file.readline return @line end rescue EOFError return false end end
this method reads a line of the logfile and calls the parser @return [Object] parsed object if not called with a block(default: Surricata::Fast) @return [false] if there is nothing to read and if not called with a block @yieldparam [Object] @line parsed object(default Suricata::Fast
)
# File lib/suricata/logfile.rb, line 79 def readline_parse if block_given? while readline yield(parse(@line)) end else if not readline return false else return parse(@line) end end end