示例#1
0
/** check alert rules and update values */
static void update_alerts( alert_item_t * old_items, unsigned int old_count,
                           alert_item_t * new_items, unsigned int new_count,
                           const char *block_name )
{
    unsigned int   i;

    if ( old_count != new_count )
    {
        DisplayLog( LVL_MAJOR, "EntryProc_Config",
                    "Alert rules count changed in block '%s' but cannot be modified dynamically: alert update cancelled",
                    block_name );
        return;
    }

    /* compare alert boolean expression structure */
    for ( i = 0; i < new_count; i++ )
    {
        if ( ( old_items[i].attr_mask != new_items[i].attr_mask )
             || compare_boolexpr( &old_items[i].boolexpr, &new_items[i].boolexpr ) )
        {
            DisplayLog( LVL_MAJOR, "EntryProc_Config",
                        "Alert expression #%u changed in block '%s'. Only numerical values can be modified dynamically. Alert update cancelled",
                        i, block_name );
            return;
        }
    }

    /* if they are all the same, update/check their values */

    for ( i = 0; i < new_count; i++ )
    {
        if ( update_boolexpr( &old_items[i].boolexpr, &new_items[i].boolexpr ) )
        {
            char           criteriastr[2048];
            BoolExpr2str( &old_items[i].boolexpr, criteriastr, 2048 );
            DisplayLog( LVL_EVENT, "EntryProc_Config",
                        "Alert expression #%u in block '%s' has been updated and is now: %s", i,
                        block_name, criteriastr );
        }
    }

    /* XXX attr_mask is unchanged, since we keep the same expression structures */

}
示例#2
0
static int alerter_alert(const entry_id_t *p_entry_id, attr_set_t *p_attrs,
                         const action_params_t *params, post_action_e *after,
                         db_cb_func_t db_cb_fn, void *db_cb_arg)
{
    char *str_id = NULL;
    bool  str_is_alloc = false;
    GString *gs = g_string_new(NULL);

    /* build alert string */
    if (ATTR_MASK_TEST(p_attrs, fullpath))
    {
        str_id = ATTR(p_attrs, fullpath);
    }
    else
    {
        asprintf(&str_id, DFID, PFID(p_entry_id));
        str_is_alloc = true;
    }

    /** TODO build specific parameter that represents the alert rule */
    #if 0
    rc = BoolExpr2str(&entry_proc_conf.alert_list[i].boolexpr, stralert, 2*RBH_PATH_MAX);
    if ( rc < 0 )
        strcpy( stralert, "Error building alert string" );
    #endif

    /** TODO build specific parameter that represents attr mask for the rule (alert mask) */

    print_attrs(gs, p_attrs, null_mask, 0);

    /* title: alert rule name */
    RaiseEntryAlert(rbh_param_get(params, "title"), "entry matches alert rule",
                    str_id, gs->str);

    g_string_free(gs, TRUE);
    if (str_is_alloc)
        free(str_id);

    return 0;
}
示例#3
0
/* build filters depending on program options */
static int mkfilters(int exclude_dirs)
{
    filter_value_t fv;
    int compflag;

    /* create boolean expression for matching */

    if (prog_options.match_user)
    {
        compare_value_t val;
        strcpy(val.str, prog_options.user);
        if (prog_options.userneg)
            compflag = COMP_UNLIKE;
        else
            compflag = COMP_LIKE;
        if (!is_expr)
            CreateBoolCond(&match_expr, compflag, CRITERIA_OWNER, val);
        else
            AppendBoolCond(&match_expr, compflag, CRITERIA_OWNER, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_owner;
    }

    if (prog_options.match_group)
    {
        compare_value_t val;
        strcpy(val.str, prog_options.group);
        if (prog_options.groupneg)
            compflag = COMP_UNLIKE;
        else
            compflag = COMP_LIKE;
        if (!is_expr)
            CreateBoolCond(&match_expr, compflag, CRITERIA_GROUP, val);
        else
            AppendBoolCond(&match_expr, compflag, CRITERIA_GROUP, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_gr_name;
    }

    if (prog_options.match_name)
    {
        /* this is not converted to DB filter, but will be used in post checking */
        compare_value_t val;
        strcpy(val.str, prog_options.name);
        if (prog_options.nameneg)
            compflag = COMP_UNLIKE;
        else
            compflag = COMP_LIKE;
        if (!is_expr)
            CreateBoolCond(&match_expr, compflag, CRITERIA_FILENAME, val);
        else
            AppendBoolCond(&match_expr, compflag, CRITERIA_FILENAME, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_name;
    }

    if (prog_options.match_size)
    {
        compare_value_t val;
        val.size = prog_options.sz_val;
        if (!is_expr)
            CreateBoolCond(&match_expr, prog_options.sz_compar, CRITERIA_SIZE, val);
        else
            AppendBoolCond(&match_expr, prog_options.sz_compar, CRITERIA_SIZE, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_size;
    }

    if (prog_options.match_crtime)
    {
        compare_value_t val;
        val.duration = prog_options.crt_val;
        if (!is_expr)
            CreateBoolCond(&match_expr, prog_options.crt_compar, CRITERIA_CREATION, val);
        else
            AppendBoolCond(&match_expr, prog_options.crt_compar, CRITERIA_CREATION, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_creation_time;
    }

    if (prog_options.match_mtime)
    {
        compare_value_t val;
        val.duration = prog_options.mod_val;
        if (!is_expr)
            CreateBoolCond(&match_expr, prog_options.mod_compar, CRITERIA_LAST_MOD, val);
        else
            AppendBoolCond(&match_expr, prog_options.mod_compar, CRITERIA_LAST_MOD, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_last_mod;
    }

    if (prog_options.match_atime)
    {
        compare_value_t val;
        val.duration = prog_options.acc_val;
        if (!is_expr)
            CreateBoolCond(&match_expr, prog_options.acc_compar, CRITERIA_LAST_ACCESS, val);
        else
            AppendBoolCond(&match_expr, prog_options.acc_compar, CRITERIA_LAST_ACCESS, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_last_access;
    }
#ifdef _LUSTRE
    if (prog_options.match_ost)
    {
        /* this partially converted to DB filter, and will be fully used in post checking */
        compare_value_t val;
        val.integer = prog_options.ost_idx;
        if (!is_expr)
            CreateBoolCond(&match_expr, COMP_EQUAL, CRITERIA_OST, val);
        else
            AppendBoolCond(&match_expr, COMP_EQUAL, CRITERIA_OST, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_stripe_items;
    }

    if (prog_options.match_pool)
    {
        compare_value_t val;
        strcpy(val.str, prog_options.pool);
        if (!is_expr)
            CreateBoolCond(&match_expr, COMP_LIKE, CRITERIA_POOL, val);
        else
            AppendBoolCond(&match_expr, COMP_LIKE, CRITERIA_POOL, val);
        is_expr = 1;
        query_mask |= ATTR_MASK_stripe_info;
    }
#endif

    /* create DB filters */
    lmgr_simple_filter_init( &entry_filter );

    /* analyze type filter */
    if (prog_options.match_type)
    {
        if (!strcasecmp(prog_options.type, STR_TYPE_DIR))
        {
            /* only match dirs */
            prog_options.dir_only = 1;
            if (!exclude_dirs)
            {
                fv.value.val_str = STR_TYPE_DIR;
                lmgr_simple_filter_add(&entry_filter, ATTR_INDEX_type, EQUAL, fv, 0);
            }
        }
        else
        {
            /* smthg different from dir */
            prog_options.no_dir = 1;
            fv.value.val_str = prog_options.type;
            lmgr_simple_filter_add(&entry_filter, ATTR_INDEX_type, EQUAL, fv, 0);
        }
    }
    else if (exclude_dirs) /* no specific type specified => exclude dirs if required */
    {
        /* filter non directories (directories are handled during recursive DB scan) */
        fv.value.val_str = STR_TYPE_DIR;
        lmgr_simple_filter_add( &entry_filter, ATTR_INDEX_type, NOTEQUAL, fv, 0 );
    }

#ifdef ATTR_INDEX_status
    if (prog_options.match_status)
    {
        if (prog_options.statusneg)
            compflag = NOTEQUAL;
        else
            compflag = EQUAL;
        /* not part of user policies, only add it to DB filter */
        fv.value.val_uint = prog_options.status;
        lmgr_simple_filter_add( &entry_filter, ATTR_INDEX_status, compflag, fv, 0 );
    }
#endif

    if (prog_options.match_name)
    {
        fv.value.val_str = prog_options.name;
        lmgr_simple_filter_add( &entry_filter, ATTR_INDEX_name, LIKE, fv, 0 );
    }

    /* TODO what about pool? */

    if (is_expr)
    {
        char expr[RBH_PATH_MAX];
        /* for debug */
        if (BoolExpr2str(&match_expr, expr, RBH_PATH_MAX)>0)
            DisplayLog(LVL_FULL, FIND_TAG, "Expression matching: %s", expr);

        /* append bool expr to entry filter */
        convert_boolexpr_to_simple_filter( &match_expr, &entry_filter );
    }

    return 0;
}