class Suricata::Logfile

This class opens a logfile, offers methods for reading logfiles and calls the logfile-parser

Attributes

file[R]

@!attribute file

file-descriptor for logfile

@!attribute line

current line of the logfile. set by readline and readline_parse
line[R]

@!attribute file

file-descriptor for logfile

@!attribute line

current line of the logfile. set by readline and readline_parse
logfile[RW]

@!attribute logfile

path and filename of the logfile

@!attribute parser

parser to use(default: Suricata::Fast)
parser[RW]

@!attribute logfile

path and filename of the logfile

@!attribute parser

parser to use(default: Suricata::Fast)

Public Class Methods

new(logfile,autoopen=true,file=nil) click to toggle source

constructor @param [String] logfile path and filename of the logfile @param [Boolean] autoopen calls open if true(default: true)

# File lib/suricata/logfile.rb, line 44
def initialize(logfile,autoopen=true,file=nil)
        @logfile = logfile
        @parser = Suricata::Fast.new

        if autoopen == true
                open
        else
                @file = file if not file.nil?
        end
end

Public Instance Methods

close() click to toggle source

this method closes the logfile

# File lib/suricata/logfile.rb, line 127
def close
        @file.close()
end
open() click to toggle source

this method opens the logfile and initialises file

# File lib/suricata/logfile.rb, line 122
def open
        @file = File.new(@logfile,"r")
end
parse(string) click to toggle source

this method calls parser.parse(string) @param [String] string logfile-entry to parse @raise [Exception] “Invalid argument” if string is nil @raise [Exception] “Invalid parser” if parser is nil @return [Object] parser

# File lib/suricata/logfile.rb, line 60
def parse(string)
        if string.nil?
                raise "Invalid argument"
        end

        if @parser.nil?
                raise "Invalid parser"
        end

        @parser.parse(string)

        return @parser

end
readline() { |line| ... } click to toggle source

this method reads a line of the logfile

@example readline with a block

log = Suricata::Logfile.new("misc/fast.log")
log.readline do |n|
   puts n
end

@return [String] line current logfile entry @return [Boolean] false when EOF reached @yieldparam [String] @line current logfile entry

# File lib/suricata/logfile.rb, line 104
def readline
        begin
        if block_given?
                while @line = @file.readline
                        yield(@line)
                end
        else
                @line = @file.readline
                return @line
        end
        rescue EOFError
                return false
        end


end
readline_parse() { |parse(line)| ... } click to toggle source

this method reads a line of the logfile and calls the parser @return [Object] parsed object if not called with a block(default: Surricata::Fast) @return [false] if there is nothing to read and if not called with a block @yieldparam [Object] @line parsed object(default Suricata::Fast)

# File lib/suricata/logfile.rb, line 79
def readline_parse
        if block_given?
                while readline
                        yield(parse(@line))
                end
        else
                if not readline
                        return false
                else
                        return parse(@line)
                end
        end
end