mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
79 lines
1.8 KiB
Text
79 lines
1.8 KiB
Text
# $Id: irc-bot-syslog.bro,v 1.1.4.2 2006/05/31 00:16:21 sommer Exp $
|
|
#
|
|
# Passes current bot-state to syslog.
|
|
#
|
|
# - When a new server/client is found, we syslog it immediately.
|
|
# - Every IrcBot::summary_interval we dump the current set.
|
|
|
|
@load irc-bot
|
|
|
|
module IrcBotSyslog;
|
|
|
|
export {
|
|
# Prefix for all messages for easy grepping.
|
|
const prefix = "irc-bots" &redef;
|
|
}
|
|
|
|
# For debugging, everything which goes to syslog also goes here.
|
|
global syslog_file = open_log_file("irc-bots.syslog");
|
|
|
|
function fmt_time(t: time) : string
|
|
{
|
|
return strftime("%Y-%m-%d-%H-%M-%S", t);
|
|
}
|
|
|
|
function log_server(ip: addr, new: bool)
|
|
{
|
|
local s = IrcBot::servers[ip];
|
|
local ports = IrcBot::portset_to_str(s$p);
|
|
|
|
local msg = fmt("%s ip=%s new=%d local=%d server=1 first_seen=%s last_seen=%s ports=%s",
|
|
prefix, ip, new, is_local_addr(ip),
|
|
fmt_time(s$first_seen), fmt_time(s$last_seen), ports);
|
|
|
|
syslog(msg);
|
|
print syslog_file, fmt("%.6f %s", network_time(), msg);
|
|
}
|
|
|
|
function log_client(ip: addr, new: bool)
|
|
{
|
|
local c = IrcBot::clients[ip];
|
|
local servers = IrcBot::addrset_to_str(c$servers);
|
|
|
|
local msg = fmt("%s ip=%s new=%d local=%d server=0 first_seen=%s last_seen=%s user=%s nick=%s realname=%s servers=%s",
|
|
prefix, ip, new, is_local_addr(ip),
|
|
fmt_time(c$first_seen), fmt_time(c$last_seen),
|
|
c$user, c$nick, c$realname, servers);
|
|
|
|
syslog(msg);
|
|
print syslog_file, fmt("%.6f %s", network_time(), msg);
|
|
}
|
|
|
|
event print_bot_state()
|
|
{
|
|
for ( s in IrcBot::confirmed_bot_servers )
|
|
log_server(s, F);
|
|
|
|
for ( c in IrcBot::confirmed_bot_clients )
|
|
log_client(c, F);
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
set_buf(syslog_file, F);
|
|
}
|
|
|
|
redef notice_policy += {
|
|
[$pred(a: notice_info) =
|
|
{
|
|
if ( a$note == IrcBot::IrcBotServerFound )
|
|
log_server(a$src, T);
|
|
|
|
if ( a$note == IrcBot::IrcBotClientFound )
|
|
log_client(a$src, T);
|
|
|
|
return F;
|
|
},
|
|
$result = NOTICE_FILE,
|
|
$priority = 1]
|
|
};
|