You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102
  1. // snfLOGmgr.cpp
  2. //
  3. // (C) Copyright 2006 - 2020 ARM Research Labs, LLC.
  4. // See www.armresearch.com for the copyright terms.
  5. //
  6. // Log Manager implementations see snfLOGmgr.hpp for details.
  7. #include "snfLOGmgr.hpp"
  8. #include "../CodeDweller/threading.hpp"
  9. #include "../CodeDweller/timing.hpp"
  10. #include <unistd.h>
  11. #include <sstream>
  12. #include <iomanip>
  13. namespace cd = codedweller;
  14. //// snfScanData ///////////////////////////////////////////////////////////////
  15. int snfScanData::IPScanCount() { // Return the number of IPs.
  16. return MyIPCount;
  17. }
  18. IPScanRecord& snfScanData::newIPScanRecord() { // Get the next free IP scan record.
  19. if(MaxIPsPerMessage <= MyIPCount) { // Check that we have more records.
  20. throw NoFreeIPScanRecords(); // If we do not then throw!
  21. } // If we do have more records then
  22. IPScanRecord& NewRecord = MyIPScanData[MyIPCount]; // Pick the next available one,
  23. NewRecord.Ordinal = MyIPCount; // set the ordinal value,
  24. ++MyIPCount; // increase our count, and
  25. return NewRecord; // return the one we picked.
  26. }
  27. IPScanRecord& snfScanData::IPScanData(int i) { // Return the IP scan record i.
  28. if(MyIPCount <= i || 0 > i) { // First check that i is in bounds.
  29. throw OutOfBounds(); // if it is not then throw!
  30. } // If the record for [i] is available
  31. return MyIPScanData[i]; // return it.
  32. }
  33. void snfScanData::drillPastOrdinal(int O) { // Sets Drill Down flag for IP record O.
  34. if(0 <= O && O < MaxIPsPerMessage) { // If O is a useable Received ordinal
  35. DrillDownFlags[O] = true; // then set the Drill Down Flag for O.
  36. }
  37. }
  38. bool snfScanData::isDrillDownSource(IPScanRecord& X) { // True if we drill through this source.
  39. if(
  40. (0UL != myCallerForcedSourceIP) || // If the source IP has been forced by
  41. (0UL != myHeaderDirectiveSourceIP) // the caller or by a header directive
  42. ) return false; // then drilldowns are disabled.
  43. // Otherwise check for a drilldown flag.
  44. return DrillDownFlags[X.Ordinal]; // Presuming X is valid, return the flag.
  45. } // If X is not valid we may blow up!
  46. IPScanRecord& snfScanData::SourceIPRecord(IPScanRecord& X) { // Sets the source IP record.
  47. SourceIPOrdinal = X.Ordinal; // Here's the ordinal.
  48. SourceIPFoundFlag = true; // Here's the truth flag.
  49. return X; // Return what was set.
  50. }
  51. IPScanRecord& snfScanData::SourceIPRecord() { // Gets the source IP record.
  52. return IPScanData(SourceIPOrdinal); // Return the IP record, or throw
  53. } // OutOfBounds.
  54. bool snfScanData::FoundSourceIP() { // True if the source IP record was set.
  55. return SourceIPFoundFlag; // Return what the flag says.
  56. }
  57. snfIPRange snfScanData::SourceIPRange(snfIPRange R) { // Establish the IP range.
  58. return (SourceIPRangeFlag = R); // set and return the value w/ R.
  59. }
  60. snfIPRange snfScanData::SourceIPRange() { // Gets the source IP detection range.
  61. return SourceIPRangeFlag; // Return what the flag says.
  62. }
  63. cd::IP4Address snfScanData::HeaderDirectiveSourceIP(cd::IP4Address A) { // set Header directive source IP.
  64. if(0UL == myHeaderDirectiveSourceIP) myHeaderDirectiveSourceIP = A; // If this value is not set, set it.
  65. return myHeaderDirectiveSourceIP; // Return the value.
  66. }
  67. cd::IP4Address snfScanData::HeaderDirectiveSourceIP() { // get Header directive source IP.
  68. return myHeaderDirectiveSourceIP; // Return the current value.
  69. }
  70. cd::IP4Address snfScanData::CallerForcedSourceIP(cd::IP4Address A) { // set Caller forced source IP.
  71. if(0UL == myCallerForcedSourceIP) myCallerForcedSourceIP = A; // If this value is not set, set it.
  72. return myCallerForcedSourceIP; // Return the value.
  73. }
  74. cd::IP4Address snfScanData::CallerForcedSourceIP() { // get Caller forced source IP.
  75. return myCallerForcedSourceIP; // Return the current value.
  76. }
  77. //// snfLOGmgr /////////////////////////////////////////////////////////////////
  78. void snfLOGmgr::updateActiveUTC(std::string ActiveUTC) { // Update Active Rulebase UTC.
  79. cd::ScopeMutex Freeze(MyMutex); // Protect the strings.
  80. ActiveRulebaseUTC = ActiveUTC; // Update the active timestamp.
  81. NewerRulebaseIsAvailable = false; // Update availability is now unknown.
  82. }
  83. void snfLOGmgr::updateAvailableUTC(std::string& AvailableRulebaseTimestamp) { // Changes update avialability stamp.
  84. cd::ScopeMutex Freeze(MyMutex); // Protect the strings.
  85. AvailableRulebaseUTC = AvailableRulebaseTimestamp; // Store the new timestamp.
  86. if(0 < AvailableRulebaseUTC.compare(ActiveRulebaseUTC)) { // If the available timestamp is newer
  87. NewerRulebaseIsAvailable = true; // than the active then set the flag.
  88. } else { // If it is not newer then
  89. NewerRulebaseIsAvailable = false; // reset the flag.
  90. }
  91. }
  92. std::string snfLOGmgr::ActiveRulebaseTimestamp() { // Get active rulebase timestamp.
  93. cd::ScopeMutex Freeze(MyMutex); // Protect the string.
  94. return ActiveRulebaseUTC; // Return it.
  95. }
  96. std::string snfLOGmgr::AvailableRulebaseTimestamp() { // Get available rulebase timestamp.
  97. cd::ScopeMutex Freeze(MyMutex); // Protect the strings.
  98. return AvailableRulebaseUTC; // Return the available timestamp.
  99. }
  100. bool snfLOGmgr::isUpdateAvailable() { // True if update is available.
  101. return NewerRulebaseIsAvailable; // Return the flag's value.
  102. }
  103. int snfLOGmgr::LatestRuleID() { // Query the latest rule id.
  104. return Status.LatestRuleID; // This simple value is atomic
  105. } // so we can read it without the mutex.
  106. int snfLOGmgr::RunningTime() { // Get the time we've been alive.
  107. return (int) difftime(Timestamp(), StartupTime);
  108. }
  109. //// DiscLogger ////////////////////////////////////////////////////////////////
  110. const cd::ThreadType DiscLogger::Type("DiscLogger"); // The thread's type.
  111. const cd::ThreadState DiscLogger::DiscLogger_Flush("Flushing"); // Flushing state.
  112. const cd::ThreadState DiscLogger::DiscLogger_Wait("Waiting"); // Waiting state.
  113. DiscLogger::DiscLogger(std::string N) : // When it is time to start...
  114. Thread(DiscLogger::Type, N), // DiscLogger Type and Name.
  115. UseANotB(true), // Set all of the flags to their
  116. isDirty(false), // appropriate initial state
  117. isBad(false), // then start the thread.
  118. isTimeToStop(false),
  119. inAppendMode(true),
  120. isEnabled(true) {
  121. run();
  122. }
  123. DiscLogger::~DiscLogger() { // When it is time to go away...
  124. isTimeToStop = true; // Set the stop flag.
  125. flush(); // Flush if we should.
  126. join(); // Wait for the thread to stop.
  127. }
  128. void DiscLogger::post(const std::string Input, const std::string NewPath) { // Post Input to log.
  129. if(!isEnabled) return; // If we're not enabled, eat it.
  130. cd::ScopeMutex PostingNewDataNobodyMove(BufferControlMutex); // Keep things static while posting.
  131. if(0 < NewPath.length()) { myPath = NewPath; } // Reset the path if provided.
  132. std::string& Buffer = PostingBuffer(); // Grab the posting buffer.
  133. if(!inAppendMode) Buffer.clear(); // If overwriting, clear the old.
  134. Buffer.append(Input); // Add the new data.
  135. isDirty = true; // We're dirty now.
  136. }
  137. // The DiscLogger flush() method is designed to lose data if it is unable to
  138. // write the data to the file. The alternative would allow an unlimited amount
  139. // of data to build up in the buffers and that would be bad.
  140. void DiscLogger::flush() { // Flush right now!
  141. std::string FilePath; // Local copy of the path.
  142. cd::ScopeMutex FlushingNow(FlushMutex); // We're flushing.
  143. if(isDirty) { // Nothing to do if not dirty.
  144. BufferControlMutex.lock(); // Lock the buffer controls.
  145. FlushingBuffer().clear(); // Clear the old flushing buffer.
  146. UseANotB = (!UseANotB); // Flip the buffers.
  147. isDirty = false; // We are not dirty anymore.
  148. std::string& Buffer = FlushingBuffer(); // Grab the new flushing buffer.
  149. FilePath = myPath; // Grab the current file path.
  150. BufferControlMutex.unlock(); // Unlock the buffer controls.
  151. try { // Insulate against exceptions.
  152. std::ofstream File( // Open the file.
  153. FilePath.c_str(), // Use the path we have.
  154. (inAppendMode) ? (std::ios::app) : (std::ios::trunc) // Append or Truncate appropriately.
  155. );
  156. File << Buffer; // Write the buffer.
  157. if(File.bad()) throw false; // If someting went wrong, throw.
  158. File.close(); // Close the file.
  159. }
  160. catch(...) { // If we had an exception then
  161. isBad = true; // make sure the bad bit is on and
  162. return; // we are done.
  163. }
  164. isBad = false; // If nothing went wrong we're good!
  165. }
  166. }
  167. void DiscLogger::myTask() { // Main thread task
  168. cd::Sleeper WaitASecond(1000); // How to wait for 1 second.
  169. while(!isTimeToStop) { // Until it is time to stop:
  170. CurrentThreadState(DiscLogger_Wait); // post our waiting and
  171. WaitASecond(); // we wait a second, then
  172. CurrentThreadState(DiscLogger_Flush); // post our activity and
  173. flush(); // flush our data to disc
  174. } // then do it again.
  175. }
  176. //// snfScanData ///////////////////////////////////////////////////////////////
  177. snfScanData::snfScanData(int ScanHorizon) : // How to create.
  178. ReadyToClear(true), // Make sure initial clear will happen.
  179. FilteredData(ScanHorizon, 0) { // Allocate the Filtered Data buffer.
  180. clear(); // Start with no data.
  181. }
  182. snfScanData::~snfScanData() { // Cleans up lists etc.
  183. ReadyToClear = true; // Make sure the clear will happen.
  184. clear(); // Say we have no data.
  185. }
  186. void snfScanData::clear() { // Clear the data for the next message.
  187. if(!ReadyToClear) return; // Don't double clear.
  188. ReadyToClear = false; // No clearing now until logged.
  189. // Clear the IP scan data
  190. memset(MyIPScanData, 0, sizeof(MyIPScanData)); // Clear the IP scan data and
  191. MyIPCount = 0; // the count of scanned IPs.
  192. memset(DrillDownFlags, 0, sizeof(DrillDownFlags)); // Clear all DrillDown flags.
  193. SourceIPOrdinal = -1; // There is no source IP because it
  194. SourceIPFoundFlag = false; // has not yet been found.
  195. SourceIPRangeFlag = Unknown; // Range flag is not yet known.
  196. SourceIPEvaluation.clear(); // No eval yet.
  197. myHeaderDirectiveSourceIP = 0UL; // Header directive source is empty now.
  198. myCallerForcedSourceIP = 0UL; // Caller forced source is empty now.
  199. // Clear basic message stats & id info.
  200. StartOfJobUTC = 0; // Clear the start of job clock.
  201. SetupTime = 0; // Time in ms spent setting up to scan.
  202. ScanName.clear(); // Identifying name or message file name.
  203. /** The Timer ScanTime is explicitely NOT reset during clear() operations.
  204. *** Instead, the ScanTime Timer is controlled as a ScopeTimer() during the
  205. *** scan() operation exclusively.
  206. **/
  207. ScanSize = 0; // Scan size is zero.
  208. ScanDepth = 0; // Scan depth is zero.
  209. // Log entries and X- headers
  210. ClassicLogText.clear(); // Classic log entry text if any.
  211. XMLLogText.clear(); // XML log entry text if any.
  212. XHDRsText.clear(); // XHeaders text if any.
  213. XHeaderInjectOn = false; // True if injecting headers is on.
  214. XHeaderFileOn = false; // True if creating .xhdr file is on.
  215. // Clear the GBUdb Event Tracking Flags
  216. GBUdbNormalTriggered = false; // True if GBUdb indeterminate IP source.
  217. GBUdbWhiteTriggered = false; // True if GBUdb found source IP white.
  218. GBUdbWhiteSymbolForced = false; // True if white was on and symbol was set.
  219. GBUdbPatternSourceConflict = false; // True if a pattern was found with a white IP.
  220. GBUdbAutoPanicTriggered = false; // True if autopanic was triggered.
  221. GBUdbAutoPanicExecuted = false; // True if an autopanic was added.
  222. GBUdbBlackTriggered = false; // True if GBUdb found source IP black.
  223. GBUdbBlackSymbolForced = false; // True if black was on and symbol was set.
  224. GBUdbTruncateTriggered = false; // True if Truncate was possible.
  225. GBUdbPeekTriggered = false; // True if we could peek.
  226. GBUdbSampleTriggered = false; // True if we could sample.
  227. GBUdbTruncateExecuted = false; // True if we actually did truncate.
  228. GBUdbPeekExecuted = false; // True if we peeked instead of truncating.
  229. GBUdbSampleExecuted = false; // True if we sampled.
  230. GBUdbCautionTriggered = false; // True if GBUdb found source IP suspicous.
  231. GBUdbCautionSymbolForced = false; // True if caution was on and symbol was set.
  232. // Clear the rule panic tracking list
  233. RulePanics.clear(); // Remove all entries.
  234. // Pattern Engine Scan Result Data
  235. HeaderDirectiveFlags = 0UL; // Flags set by header directives.
  236. PatternWasFound = false; // True if a pattern was found.
  237. PatternID = 0; // Rule ID of the pattern.
  238. PatternSymbol = 0; // Symbol of the pattern.
  239. MatchRecords.clear(); // Clear the match records list.
  240. MatchRecordsCursor = MatchRecords.end(); // Init the cursor to nowhere.
  241. CompositeFinalResult = -1;
  242. }
  243. //// snfCounterPack ////////////////////////////////////////////////////////////
  244. snfCounterPack::snfCounterPack() { // When constructing a counter pack
  245. reset(); // reset it.
  246. }
  247. void snfCounterPack::reset() { // When asked to reset we do this:
  248. memset(&Events, 0, sizeof(Events)); // Fill them with zeros.
  249. }
  250. //// IntervalTimer /////////////////////////////////////////////////////////////
  251. cd::Timer& IntervalTimer::Active() { // Return the active timer.
  252. return ((ANotB)?A:B); // If A is active, return A
  253. } // otherwise return B.
  254. cd::Timer& IntervalTimer::Inactive() { // Return the inactive timer.
  255. return ((ANotB)?B:A); // If A is active, return B
  256. } // otherwise return A.
  257. cd::msclock IntervalTimer::hack() { // Chop off a new interval & return it.
  258. Inactive().start(Active().stop()); // Stop the active clock and reference
  259. ANotB = !ANotB; // it to start the new Active clock.
  260. return Interval(); // Flip the bit and return the Interval.
  261. }
  262. cd::msclock IntervalTimer::Interval() { // Return the last interval.
  263. return Inactive().getElapsedTime(); // Return the Inactive elapsed time.
  264. }
  265. cd::msclock IntervalTimer::Elapsed() { // Return the time since last hack.
  266. return Active().getElapsedTime(); // Return the Active elapsed time.
  267. }
  268. //// snfLOGmgr /////////////////////////////////////////////////////////////////
  269. const cd::ThreadType snfLOGmgr::Type("snfLOGmgr"); // The thread's type.
  270. snfLOGmgr::snfLOGmgr() : // Constructor for the LOG manager
  271. Thread(snfLOGmgr::Type, "Log Manager"), // snfLOGmgr Type and Name.
  272. Configured(false), // Not yet configured.
  273. TimeToDie(false), // Not yet time to die.
  274. PeekEnableCounter(0), // No peeking yet.
  275. SampleEnableCounter(0), // No sampling yet.
  276. myNETmgr(NULL), // No NET mgr yet.
  277. myGBUdb(NULL), // No GBUdb yet.
  278. NewerRulebaseIsAvailable(false), // No newer rulebase yet.
  279. SecondStatusLogger("Second Status Logger"), // Lazy writer for Second status.
  280. MinuteStatusLogger("Minute Status Logger"), // Lazy writer for Minute status.
  281. HourStatusLogger("Hour Status Logger"), // Lazy writer for Hour status.
  282. XMLScanLogger("XML Scan Logger"), // Lazy writer for XML Scan log.
  283. ClassicScanLogger("Classic Scan Logger") { // Lazy writer for Classic Scan log.
  284. StartupTime = Timestamp(); // Record when did we start.
  285. CurrentCounters = &CounterPackA; // Assign the active CounterPack.
  286. ReportingCounters = &CounterPackB; // Assign the reporting CounterPack.
  287. Timestamp(SecondReportTimestamp); // Set the basetime for the Second,
  288. Timestamp(MinuteReportTimestamp); // Minute, and Hour status reports.
  289. Timestamp(HourReportTimestamp);
  290. run(); // Run the thread.
  291. }
  292. snfLOGmgr::~snfLOGmgr() { // When we go away we must
  293. stop(); // stop if we haven't already.
  294. if(Configured) Status.store(PersistentFileName); // If safe, store our persistent data.
  295. }
  296. void snfLOGmgr::linkNETmgr(snfNETmgr& N) { myNETmgr = &N; } // Link in my NETmgr
  297. void snfLOGmgr::linkGBUdb(GBUdb& G) { myGBUdb = &G; } // Link in my GBUdb
  298. void snfLOGmgr::stop() { // When we want to stop
  299. if(!TimeToDie) { // check that we didn't already, then
  300. TimeToDie = true; // we set time to die and
  301. join(); // join the thread;
  302. }
  303. }
  304. //// Here are some functions for creating status reports.
  305. // Handy subroutine to encapsulate status log posting logic.
  306. void snfLOGmgr::postStatusLog( // Post a Status log if required.
  307. const std::string& LogData, // Here's the log entry's data.
  308. const std::string& LogFileName, // Here is where it should go.
  309. const bool LogEnabled, // This is true if we should write it.
  310. const bool AppendNotOverwrite, // True=Append, False=Overwrite.
  311. DiscLogger& Logger // The logger to use.
  312. ) {
  313. if(!LogEnabled) return; // If we're not supposed to, don't!
  314. std::string TFN = LogFileName; // Tagged File Name
  315. if(AppendNotOverwrite) { // If we're appending, rotate per day.
  316. TFN.append("."); // Put a timestamp on the file name.
  317. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  318. else { Timestamp(TFN); } // the utc timestamp as configured.
  319. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  320. }
  321. TFN.append(".log.xml"); // Tack on the extension.
  322. // Now feed this to the lazy logger.
  323. Logger.Enabled(LogEnabled); // Set the enable flag.
  324. Logger.AppendMode(AppendNotOverwrite); // Set the append mode.
  325. Logger.post(LogData, TFN); // Post data and update the name.
  326. }
  327. // Handy function to normalize data to a base.
  328. // Also, a collection of handy bases to normalize to ;-)
  329. const int MillisecondsInASecond = 1000; // Second
  330. const int MillisecondsInAMinute = MillisecondsInASecond * 60; // Minute
  331. const int MillisecondsInAnHour = MillisecondsInAMinute * 60; // Hour
  332. const int MillisecondsInADay = MillisecondsInAnHour * 24; // Day
  333. double snf_rationalize(double Count, double Base, double NewBase) { // Cross multiply to convert bases.
  334. if(0.0 == Base) return 0.0; // Handle division by zero like this.
  335. return (Count * NewBase) / Base; // Do the math.
  336. }
  337. double snf_AveragePerSecond(snf_SMHDMY_Counter& D, snf_SMHDMY_Counter& T) { // Avg Data/sec given Data & Time Counters.
  338. return snf_rationalize(
  339. D.SEC6SUM, T.SEC6SUM, MillisecondsInASecond);
  340. }
  341. double snf_AveragePerMinute(snf_SMHDMY_Counter& D, snf_SMHDMY_Counter& T) { // Avg Data/min given Data & Time Counters.
  342. return snf_rationalize(
  343. D.SumThru1Minute(), T.SumThru1Minute(), MillisecondsInAMinute);
  344. }
  345. double snf_AveragePerHour(snf_SMHDMY_Counter& D, snf_SMHDMY_Counter& T) { // Avg Data/min given Data & Time Counters.
  346. return snf_rationalize(
  347. D.SumThru1Hour(), T.SumThru1Hour(), MillisecondsInAnHour);
  348. }
  349. double snf_AveragePerDay(snf_SMHDMY_Counter& D, snf_SMHDMY_Counter& T) { // Avg Data/min given Data & Time Counters.
  350. return snf_rationalize(
  351. D.SumThru1Day(), T.SumThru1Day(), MillisecondsInADay);
  352. }
  353. void AppendRatesElement( // Format & output a rates element.
  354. const char* Name, // The name of the element (usually 1 char).
  355. snf_SMHDMY_Counter& D, // Data counter
  356. snf_SMHDMY_Counter& T, // Time counter
  357. std::ostringstream& S) { // Where to append the formatted output.
  358. S << "\t\t<" << Name << " "
  359. << "s=\'" << snf_AveragePerSecond(D, T) << "\' "
  360. << "m=\'" << snf_AveragePerMinute(D, T) << "\' "
  361. << "h=\'" << snf_AveragePerHour(D, T) << "\' "
  362. << "d=\'" << snf_AveragePerDay(D, T) << "\'/>"
  363. << std::endl;
  364. }
  365. void AppendHistogramElements(cd::Histogram& H, std::ostringstream& S) { // Format & output a histogram.
  366. if(0 < H.size()) { // Don't output empty histograms.
  367. S << "\t\t<histogram hits=\'" << H.Hits() << "\'>" << std::endl; // Open tag w/ hits count.
  368. std::set<cd::HistogramRecord>::iterator iH; // Use an iterator to
  369. for(iH = H.begin(); iH != H.end(); iH++) { // loop through all of the groups.
  370. S << "\t\t\t<g k=\'" // For each group in the histogram
  371. << (*iH).Key << "\' c=\'" // output the key value and
  372. << (*iH).Count << "\'/>" << std::endl; // the count of hits.
  373. }
  374. S << "\t\t</histogram>" << std::endl; // Close tag.
  375. }
  376. }
  377. // This gets called once per second. It is responsible for inputting the base
  378. // data into all of the histograms and counter mechnisms. After that, the minute
  379. // and hour reports are triggered when a full cycle of lower order data has
  380. // been collected.
  381. bool snfLOGmgr::do_SecondReport() { // Send our 1 second status report.
  382. // First thing - we always update the summaries for everybody :-)
  383. snfCounterPack& Counters = (*(getSnapshot())); // Get and swap the counters.
  384. TimeCounter.input(Counters.ActiveTime.getElapsedTime()); // Add the time interval.
  385. MessageCounter.input(Counters.Events.Scans); // Add the number of scans (messages).
  386. SpamCounter.input(Counters.Events.Spam); // Add the number of Spam events.
  387. HamCounter.input(Counters.Events.Ham); // Add the number of Ham events.
  388. WhiteCounter.input(Counters.Events.GBUdbWhiteSymbolForced); // Add the number of White events.
  389. CautionCounter.input(Counters.Events.GBUdbCautionSymbolForced); // Add the number of Caution events.
  390. BlackCounter.input(Counters.Events.GBUdbBlackSymbolForced); // Add the number of Black events.
  391. TruncateCounter.input(Counters.Events.GBUdbTruncateExecuted); // Add the number of Truncate events.
  392. SampleCounter.input(Counters.Events.GBUdbSampleExecuted); // Add the number of Sample events.
  393. AutoPanicCounter.input(Counters.Events.GBUdbAutoPanicTriggered); // Add the number of AutoPanic events.
  394. RulePanicCounter.input(Counters.Events.RulePanicFound); // Add the number of RulePanic events.
  395. // Next we produce our "Second" status report.
  396. std::ostringstream Report;
  397. //-- Report the stats element --
  398. Report << "<stats nodeid=\'" << NodeId << "\' "
  399. << "basetime=\'" << SecondReportTimestamp << "\' "
  400. << "elapsed=\'" << Counters.ActiveTime.getElapsedTime() << "\' "
  401. << "class=\'second\'>" << std::endl;
  402. SecondReportTimestamp = ""; Timestamp(SecondReportTimestamp); // Reset the timestamp for next time.
  403. //-- Version data --
  404. Report << "\t<version>" << std::endl
  405. << "\t\t<engine>" << SNF_ENGINE_VERSION << "</engine>" << std::endl;
  406. if(0 < myPlatformVersion.length()) {
  407. Report << "\t\t<platform>" << myPlatformVersion << "</platform>" << std::endl;
  408. }
  409. Report << "\t</version>" << std::endl;
  410. //-- Timers section --
  411. Report << "\t<timers>" << std::endl;
  412. Report << "\t\t<run started=\'" << Timestamp(StartupTime) << "\' "
  413. << "elapsed=\'" << SecsSinceStartup() << "\'/>" << std::endl;
  414. Report << "\t\t<sync latest=\'" << Timestamp(Status.LastSyncTime) << "\' "
  415. << "elapsed=\'" << SecsSinceLastSync() << "\'/>" << std::endl;
  416. Report << "\t\t<save latest=\'" << Timestamp(Status.LastSaveTime) << "\' "
  417. << "elapsed=\'" << SecsSinceLastSave() << "\'/>" << std::endl;
  418. Report << "\t\t<condense latest=\'" << Timestamp(Status.LastCondenseTime) << "\' "
  419. << "elapsed=\'" << SecsSinceLastCondense() << "\'/>" << std::endl;
  420. Report << "\t</timers>" << std::endl;
  421. //-- GBUdb section --
  422. Report << "\t<gbudb>" << std::endl;
  423. Report << "\t\t<size bytes=\'" << (*myGBUdb).Size() << "\'/>" << std::endl;
  424. Report << "\t\t<records count=\'" << (*myGBUdb).IPCount() << "\'/>" << std::endl;
  425. Report << "\t\t<utilization percent=\'" << (*myGBUdb).Utilization() << "\'/>" << std::endl;
  426. Report << "\t</gbudb>" << std::endl;
  427. //-- Counters --
  428. Report << "\t<counters>" << std::endl;
  429. if(0 < Counters.Events.Scans) {
  430. Report << "\t\t<m c=\'" << Counters.Events.Scans << "\'/>" << std::endl;
  431. }
  432. if(0 < Counters.Events.Spam) {
  433. Report << "\t\t<s c=\'" << Counters.Events.Spam << "\'/>" << std::endl;
  434. }
  435. if(0 < Counters.Events.Ham) {
  436. Report << "\t\t<h c=\'" << Counters.Events.Ham << "\'/>" << std::endl;
  437. }
  438. if(0 < Counters.Events.GBUdbTruncateExecuted) {
  439. Report << "\t\t<t c=\'" << Counters.Events.GBUdbTruncateExecuted << "\'/>" << std::endl;
  440. }
  441. if(0 < Counters.Events.GBUdbBlackSymbolForced) {
  442. Report << "\t\t<b c=\'" << Counters.Events.GBUdbBlackSymbolForced << "\'/>" << std::endl;
  443. }
  444. if(0 < Counters.Events.GBUdbCautionSymbolForced) {
  445. Report << "\t\t<c c=\'" << Counters.Events.GBUdbCautionSymbolForced << "\'/>" << std::endl;
  446. }
  447. if(0 < Counters.Events.GBUdbWhiteSymbolForced) {
  448. Report << "\t\t<w c=\'" << Counters.Events.GBUdbWhiteSymbolForced << "\'/>" << std::endl;
  449. }
  450. if(0 < Counters.Events.GBUdbAutoPanicExecuted) {
  451. Report << "\t\t<a c=\'" << Counters.Events.GBUdbAutoPanicExecuted << "\'/>" << std::endl;
  452. }
  453. if(0 < Counters.Events.RulePanicFound) {
  454. Report << "\t\t<r c=\'" << Counters.Events.RulePanicFound << "\'/>" << std::endl;
  455. }
  456. Report << "\t</counters>" << std::endl;
  457. Counters.reset(); // When done, clear the counters.
  458. //-- Rates ---
  459. Report << "\t<rates>" << std::endl;
  460. AppendRatesElement("m", MessageCounter, TimeCounter, Report);
  461. AppendRatesElement("s", SpamCounter, TimeCounter, Report);
  462. AppendRatesElement("h", HamCounter, TimeCounter, Report);
  463. AppendRatesElement("w", WhiteCounter, TimeCounter, Report);
  464. AppendRatesElement("c", CautionCounter, TimeCounter, Report);
  465. AppendRatesElement("b", BlackCounter, TimeCounter, Report);
  466. AppendRatesElement("t", TruncateCounter, TimeCounter, Report);
  467. AppendRatesElement("a", AutoPanicCounter, TimeCounter, Report);
  468. AppendRatesElement("r", RulePanicCounter, TimeCounter, Report);
  469. Report << "\t</rates>" << std::endl;
  470. //-- Results ---
  471. Report << "\t<results>" << std::endl;
  472. AppendHistogramElements(ResultsSecond, Report);
  473. ResultsSecond.reset();
  474. Report << "\t</results>" << std::endl;
  475. //-- Rules ---
  476. Report << "\t<rules>" << std::endl;
  477. std::string RBUTC;
  478. Report << "\t\t<rulebase utc=\'" << (*myNETmgr).RulebaseUTC(RBUTC) << "\'/>" << std::endl;
  479. Report << "\t\t<active utc=\'" << ActiveRulebaseUTC << "\'/>" << std::endl;
  480. Report << "\t\t<update ready=\'" << ((NewerRulebaseIsAvailable)?"yes":"no")
  481. << "\' utc=\'" << AvailableRulebaseUTC << "\'/>" << std::endl;
  482. Report << "\t\t<latest rule=\'" << LatestRuleID() << "\'/>" << std::endl;
  483. AppendHistogramElements(RulesSecond, Report);
  484. RulesSecond.reset();
  485. Report << "\t</rules>" << std::endl;
  486. //-- Panics ---
  487. Report << "\t<panics>" << std::endl;
  488. AppendHistogramElements(PanicsSecond, Report);
  489. PanicsSecond.reset();
  490. Report << "\t</panics>" << std::endl;
  491. //-- Close the stats element --
  492. Report << "</stats>" << std::endl;
  493. // Now that we've built the report we need to store it and send it to
  494. // the network manager.
  495. ConfigMutex.lock(); // Freeze while we get our settings.
  496. bool LogEnabled = SecondReport_Log_OnOff; // To log or not to log?
  497. bool AppendNotOverwrite = SecondReport_Append_OnOff; // To append or overwrite?
  498. std::string LogFileName = SecondReport_Log_Filename; // What file name?
  499. ConfigMutex.unlock(); // Ok, done with that.
  500. postStatusLog( // Post a Status log if required.
  501. Report.str(), // Here's the log entry's data.
  502. LogFileName, // Here is where it should go.
  503. LogEnabled, // This is true if we should write it.
  504. AppendNotOverwrite, // True=Append, False=Overwrite.
  505. SecondStatusLogger // Lazy log writer to use.
  506. );
  507. // Just before we go we save our stat for others to see.
  508. cd::ScopeMutex HoldForStatusUpdate(StatusReportMutex); // Hold the mutex just long enough
  509. SecondReportText = Report.str(); // to post our status and return
  510. // Finally we return the test - Do we have a complete cycle in Seconds?
  511. return(TimeCounter.Cycled60Seconds()); // True on a full cycle of seconds.
  512. }
  513. bool snfLOGmgr::do_MinuteReport() { // Send our 1 minute status report.
  514. // Produce our "Minute" status report.
  515. std::ostringstream Report;
  516. //-- Report the stats element --
  517. Report << "<stats nodeid=\'" << NodeId << "\' "
  518. << "basetime=\'" << MinuteReportTimestamp << "\' "
  519. << "elapsed=\'" << TimeCounter.Sum60Seconds() << "\' "
  520. << "class=\'minute\'>" << std::endl;
  521. MinuteReportTimestamp = ""; Timestamp(MinuteReportTimestamp); // Reset the timestamp for next time.
  522. //-- Version data --
  523. Report << "\t<version>" << std::endl
  524. << "\t\t<engine>" << SNF_ENGINE_VERSION << "</engine>" << std::endl;
  525. if(0 < myPlatformVersion.length()) {
  526. Report << "\t\t<platform>" << myPlatformVersion << "</platform>" << std::endl;
  527. }
  528. Report << "\t</version>" << std::endl;
  529. //-- Timers section --
  530. Report << "\t<timers>" << std::endl;
  531. Report << "\t\t<run started=\'" << Timestamp(StartupTime) << "\' "
  532. << "elapsed=\'" << SecsSinceStartup() << "\'/>" << std::endl;
  533. Report << "\t\t<sync latest=\'" << Timestamp(Status.LastSyncTime) << "\' "
  534. << "elapsed=\'" << SecsSinceLastSync() << "\'/>" << std::endl;
  535. Report << "\t\t<save latest=\'" << Timestamp(Status.LastSaveTime) << "\' "
  536. << "elapsed=\'" << SecsSinceLastSave() << "\'/>" << std::endl;
  537. Report << "\t\t<condense latest=\'" << Timestamp(Status.LastCondenseTime) << "\' "
  538. << "elapsed=\'" << SecsSinceLastCondense() << "\'/>" << std::endl;
  539. Report << "\t</timers>" << std::endl;
  540. //-- GBUdb section --
  541. Report << "\t<gbudb>" << std::endl;
  542. Report << "\t\t<size bytes=\'" << (*myGBUdb).Size() << "\'/>" << std::endl;
  543. Report << "\t\t<records count=\'" << (*myGBUdb).IPCount() << "\'/>" << std::endl;
  544. Report << "\t\t<utilization percent=\'" << (*myGBUdb).Utilization() << "\'/>" << std::endl;
  545. Report << "\t</gbudb>" << std::endl;
  546. //-- Counters --
  547. Report << "\t<counters>" << std::endl;
  548. if(0 < MessageCounter.Sum60Seconds()) {
  549. Report << "\t\t<m c=\'" << MessageCounter.Sum60Seconds() << "\'/>" << std::endl;
  550. }
  551. if(0 < SpamCounter.Sum60Seconds()) {
  552. Report << "\t\t<s c=\'" << SpamCounter.Sum60Seconds() << "\'/>" << std::endl;
  553. }
  554. if(0 < HamCounter.Sum60Seconds()) {
  555. Report << "\t\t<h c=\'" << HamCounter.Sum60Seconds() << "\'/>" << std::endl;
  556. }
  557. if(0 < TruncateCounter.Sum60Seconds()) {
  558. Report << "\t\t<t c=\'" << TruncateCounter.Sum60Seconds() << "\'/>" << std::endl;
  559. }
  560. if(0 < BlackCounter.Sum60Seconds()) {
  561. Report << "\t\t<b c=\'" << BlackCounter.Sum60Seconds() << "\'/>" << std::endl;
  562. }
  563. if(0 < CautionCounter.Sum60Seconds()) {
  564. Report << "\t\t<c c=\'" << CautionCounter.Sum60Seconds() << "\'/>" << std::endl;
  565. }
  566. if(0 < WhiteCounter.Sum60Seconds()) {
  567. Report << "\t\t<w c=\'" << WhiteCounter.Sum60Seconds() << "\'/>" << std::endl;
  568. }
  569. if(0 < AutoPanicCounter.Sum60Seconds()) {
  570. Report << "\t\t<a c=\'" << AutoPanicCounter.Sum60Seconds() << "\'/>" << std::endl;
  571. }
  572. if(0 < RulePanicCounter.Sum60Seconds()) {
  573. Report << "\t\t<a c=\'" << RulePanicCounter.Sum60Seconds() << "\'/>" << std::endl;
  574. }
  575. Report << "\t</counters>" << std::endl;
  576. //-- Rates ---
  577. Report << "\t<rates>" << std::endl;
  578. AppendRatesElement("m", MessageCounter, TimeCounter, Report);
  579. AppendRatesElement("s", SpamCounter, TimeCounter, Report);
  580. AppendRatesElement("h", HamCounter, TimeCounter, Report);
  581. AppendRatesElement("w", WhiteCounter, TimeCounter, Report);
  582. AppendRatesElement("c", CautionCounter, TimeCounter, Report);
  583. AppendRatesElement("b", BlackCounter, TimeCounter, Report);
  584. AppendRatesElement("t", TruncateCounter, TimeCounter, Report);
  585. AppendRatesElement("a", AutoPanicCounter, TimeCounter, Report);
  586. AppendRatesElement("r", RulePanicCounter, TimeCounter, Report);
  587. Report << "\t</rates>" << std::endl;
  588. //-- Results ---
  589. Report << "\t<results>" << std::endl;
  590. AppendHistogramElements(ResultsMinute, Report);
  591. ResultsMinute.reset();
  592. Report << "\t</results>" << std::endl;
  593. //-- Rules ---
  594. Report << "\t<rules>" << std::endl;
  595. std::string RBUTC;
  596. Report << "\t\t<rulebase utc=\'" << (*myNETmgr).RulebaseUTC(RBUTC) << "\'/>" << std::endl;
  597. Report << "\t\t<active utc=\'" << ActiveRulebaseUTC << "\'/>" << std::endl;
  598. Report << "\t\t<update ready=\'" << ((NewerRulebaseIsAvailable)?"yes":"no")
  599. << "\' utc=\'" << AvailableRulebaseUTC << "\'/>" << std::endl;
  600. Report << "\t\t<latest rule=\'" << LatestRuleID() << "\'/>" << std::endl;
  601. AppendHistogramElements(RulesMinute, Report);
  602. RulesMinute.reset();
  603. Report << "\t</rules>" << std::endl;
  604. //-- Panics ---
  605. Report << "\t<panics>" << std::endl;
  606. AppendHistogramElements(PanicsMinute, Report);
  607. PanicsMinute.reset();
  608. Report << "\t</panics>" << std::endl;
  609. //-- Close the stats element --
  610. Report << "</stats>" << std::endl;
  611. // Now that we've built the report we need to store it and send it to
  612. // the network manager.
  613. ConfigMutex.lock(); // Freeze while we get our settings.
  614. bool LogEnabled = MinuteReport_Log_OnOff; // To log or not to log?
  615. bool AppendNotOverwrite = MinuteReport_Append_OnOff; // To append or overwrite?
  616. std::string LogFileName = MinuteReport_Log_Filename; // What file name?
  617. ConfigMutex.unlock(); // Ok, done with that.
  618. postStatusLog( // Post a Status log if required.
  619. Report.str(), // Here's the log entry's data.
  620. LogFileName, // Here is where it should go.
  621. LogEnabled, // This is true if we should write it.
  622. AppendNotOverwrite, // True=Append, False=Overwrite.
  623. MinuteStatusLogger // Lazy log writer to use.
  624. );
  625. (*myNETmgr).sendReport(Report.str()); // Send the status report to the net.
  626. // Just before we go we save our stat for others to see.
  627. cd::ScopeMutex HoldForStatusUpdate(StatusReportMutex); // Hold the mutex just long enough
  628. MinuteReportText = Report.str(); // to post our status and return
  629. return(TimeCounter.Cycled60Minutes()); // True at a full cycle of minutes.
  630. }
  631. bool snfLOGmgr::do_HourReport() { // Send our 1 hour status report.
  632. // Produce our "Hour" status report.
  633. std::ostringstream Report;
  634. //-- Report the stats element --
  635. Report << "<stats nodeid=\'" << NodeId << "\' "
  636. << "basetime=\'" << HourReportTimestamp << "\' "
  637. << "elapsed=\'" << TimeCounter.Sum60Minutes() << "\' "
  638. << "class=\'hour\'>" << std::endl;
  639. HourReportTimestamp = ""; Timestamp(HourReportTimestamp); // Reset the timestamp for next time.
  640. //-- Version data --
  641. Report << "\t<version>" << std::endl
  642. << "\t\t<engine>" << SNF_ENGINE_VERSION << "</engine>" << std::endl;
  643. if(0 < myPlatformVersion.length()) {
  644. Report << "\t\t<platform>" << myPlatformVersion << "</platform>" << std::endl;
  645. }
  646. Report << "\t</version>" << std::endl;
  647. //-- Timers section --
  648. Report << "\t<timers>" << std::endl;
  649. Report << "\t\t<run started=\'" << Timestamp(StartupTime) << "\' "
  650. << "elapsed=\'" << SecsSinceStartup() << "\'/>" << std::endl;
  651. Report << "\t\t<sync latest=\'" << Timestamp(Status.LastSyncTime) << "\' "
  652. << "elapsed=\'" << SecsSinceLastSync() << "\'/>" << std::endl;
  653. Report << "\t\t<save latest=\'" << Timestamp(Status.LastSaveTime) << "\' "
  654. << "elapsed=\'" << SecsSinceLastSave() << "\'/>" << std::endl;
  655. Report << "\t\t<condense latest=\'" << Timestamp(Status.LastCondenseTime) << "\' "
  656. << "elapsed=\'" << SecsSinceLastCondense() << "\'/>" << std::endl;
  657. Report << "\t</timers>" << std::endl;
  658. //-- GBUdb section --
  659. Report << "\t<gbudb>" << std::endl;
  660. Report << "\t\t<size bytes=\'" << (*myGBUdb).Size() << "\'/>" << std::endl;
  661. Report << "\t\t<records count=\'" << (*myGBUdb).IPCount() << "\'/>" << std::endl;
  662. Report << "\t\t<utilization percent=\'" << (*myGBUdb).Utilization() << "\'/>" << std::endl;
  663. Report << "\t</gbudb>" << std::endl;
  664. //-- Counters --
  665. Report << "\t<counters>" << std::endl;
  666. if(0 < MessageCounter.Sum60Minutes()) {
  667. Report << "\t\t<m c=\'" << MessageCounter.Sum60Minutes() << "\'/>" << std::endl;
  668. }
  669. if(0 < SpamCounter.Sum60Minutes()) {
  670. Report << "\t\t<s c=\'" << SpamCounter.Sum60Minutes() << "\'/>" << std::endl;
  671. }
  672. if(0 < HamCounter.Sum60Minutes()) {
  673. Report << "\t\t<h c=\'" << HamCounter.Sum60Minutes() << "\'/>" << std::endl;
  674. }
  675. if(0 < TruncateCounter.Sum60Minutes()) {
  676. Report << "\t\t<t c=\'" << TruncateCounter.Sum60Minutes() << "\'/>" << std::endl;
  677. }
  678. if(0 < BlackCounter.Sum60Minutes()) {
  679. Report << "\t\t<b c=\'" << BlackCounter.Sum60Minutes() << "\'/>" << std::endl;
  680. }
  681. if(0 < CautionCounter.Sum60Minutes()) {
  682. Report << "\t\t<c c=\'" << CautionCounter.Sum60Minutes() << "\'/>" << std::endl;
  683. }
  684. if(0 < WhiteCounter.Sum60Minutes()) {
  685. Report << "\t\t<w c=\'" << WhiteCounter.Sum60Minutes() << "\'/>" << std::endl;
  686. }
  687. if(0 < AutoPanicCounter.Sum60Minutes()) {
  688. Report << "\t\t<a c=\'" << AutoPanicCounter.Sum60Minutes() << "\'/>" << std::endl;
  689. }
  690. if(0 < RulePanicCounter.Sum60Minutes()) {
  691. Report << "\t\t<a c=\'" << RulePanicCounter.Sum60Minutes() << "\'/>" << std::endl;
  692. }
  693. Report << "\t</counters>" << std::endl;
  694. //-- Rates ---
  695. Report << "\t<rates>" << std::endl;
  696. AppendRatesElement("m", MessageCounter, TimeCounter, Report);
  697. AppendRatesElement("s", SpamCounter, TimeCounter, Report);
  698. AppendRatesElement("h", HamCounter, TimeCounter, Report);
  699. AppendRatesElement("w", WhiteCounter, TimeCounter, Report);
  700. AppendRatesElement("c", CautionCounter, TimeCounter, Report);
  701. AppendRatesElement("b", BlackCounter, TimeCounter, Report);
  702. AppendRatesElement("t", TruncateCounter, TimeCounter, Report);
  703. AppendRatesElement("a", AutoPanicCounter, TimeCounter, Report);
  704. AppendRatesElement("r", RulePanicCounter, TimeCounter, Report);
  705. Report << "\t</rates>" << std::endl;
  706. //-- Results ---
  707. Report << "\t<results>" << std::endl;
  708. AppendHistogramElements(ResultsHour, Report);
  709. ResultsHour.reset();
  710. Report << "\t</results>" << std::endl;
  711. //-- Rules ---
  712. Report << "\t<rules>" << std::endl;
  713. std::string RBUTC;
  714. Report << "\t\t<rulebase utc=\'" << (*myNETmgr).RulebaseUTC(RBUTC) << "\'/>" << std::endl;
  715. Report << "\t\t<active utc=\'" << ActiveRulebaseUTC << "\'/>" << std::endl;
  716. Report << "\t\t<update ready=\'" << ((NewerRulebaseIsAvailable)?"yes":"no")
  717. << "\' utc=\'" << AvailableRulebaseUTC << "\'/>" << std::endl;
  718. Report << "\t\t<latest rule=\'" << LatestRuleID() << "\'/>" << std::endl;
  719. AppendHistogramElements(RulesHour, Report);
  720. RulesHour.reset();
  721. Report << "\t</rules>" << std::endl;
  722. //-- Panics ---
  723. Report << "\t<panics>" << std::endl;
  724. AppendHistogramElements(PanicsHour, Report);
  725. PanicsHour.reset();
  726. Report << "\t</panics>" << std::endl;
  727. //-- Close the stats element --
  728. Report << "</stats>" << std::endl;
  729. // Now that we've built the report we need to store it and send it to
  730. // the network manager.
  731. ConfigMutex.lock(); // Freeze while we get our settings.
  732. bool LogEnabled = HourReport_Log_OnOff; // To log or not to log?
  733. bool AppendNotOverwrite = HourReport_Append_OnOff; // To append or overwrite?
  734. std::string LogFileName = HourReport_Log_Filename; // What file name?
  735. ConfigMutex.unlock(); // Ok, done with that.
  736. postStatusLog( // Post a Status log if required.
  737. Report.str(), // Here's the log entry's data.
  738. LogFileName, // Here is where it should go.
  739. LogEnabled, // This is true if we should write it.
  740. AppendNotOverwrite, // True=Append, False=Overwrite.
  741. HourStatusLogger // Lazy log writer to use.
  742. );
  743. // Just before we go we save our stat for others to see.
  744. cd::ScopeMutex HoldForStatusUpdate(StatusReportMutex); // Hold the mutex just long enough
  745. HourReportText = Report.str(); // to post our status and return
  746. return(TimeCounter.Cycled24Hours()); // True at a full cycle of hours.
  747. }
  748. void snfLOGmgr::do_StatusReports() { // Do the status reports.
  749. cd::ScopeMutex PauseWhileITotalThis(MyMutex); // Everybody stop for a bit. Each report
  750. if(do_SecondReport()) // returns true if it has cycled so
  751. if(do_MinuteReport()) // that the next report can be checked
  752. do_HourReport(); // to see if it has cycled.
  753. }
  754. void snfLOGmgr::myTask() { // Thread: Live stats & reports.
  755. cd::Sleeper WaitATic(MillisecondsInASecond); // One second sleeper.
  756. while(!TimeToDie) { // Do this until it's time to die.
  757. if(Configured) { // If we are configured do our work.
  758. do_StatusReports(); // Make our status reports (chained).
  759. }
  760. WaitATic();
  761. }
  762. }
  763. // Note about snfLOGmgr::configure() and Status.restore()
  764. // store() and restore() watch the Status.Ready flag. If
  765. // Status is ready, restore() won't. If Status is not ready
  766. // store() won't. Also, if restore() doesn't find a file, it
  767. // just clears everything and goes ready, assuming that this
  768. // is a new persistent state.
  769. void snfLOGmgr::configure(snfCFGData& CFGData) { // Update the configuration.
  770. cd::ScopeMutex HoldOnWhileITweakThisThing(ConfigMutex);
  771. PersistentFileName = CFGData.paths_workspace_path + ".state"; // Build the persistent state path.
  772. Status.restore(PersistentFileName); // Load our persistent state.
  773. NodeId = CFGData.node_licenseid; // Grab the node id for reports.
  774. // Copy the logging configuration info from CFGData
  775. Rotate_LocalTime = CFGData.Logs_Rotation_LocalTime_OnOff; // Rotate using local time?
  776. XML_Log_Mode = CFGData.Scan_XML_Mode; // What is the XML log mode.
  777. Classic_Log_Mode = CFGData.Scan_Classic_Mode; // What is the Classic log mode.
  778. LogsPath = CFGData.paths_log_path; // Path to logs directory.
  779. ClassicLogRotate = CFGData.Scan_Classic_Rotate; // True = Rotate Classic Log.
  780. XMLLogRotate = CFGData.Scan_XML_Rotate; // True = Rotate XML Log.
  781. SecondReport_Log_OnOff = CFGData.Status_SecondReport_Log_OnOff;
  782. SecondReport_Append_OnOff = CFGData.Status_SecondReport_Append_OnOff;
  783. SecondReport_Log_Filename = CFGData.paths_log_path + NodeId + ".status.second";
  784. MinuteReport_Log_OnOff = CFGData.Status_MinuteReport_Log_OnOff;
  785. MinuteReport_Append_OnOff = CFGData.Status_MinuteReport_Append_OnOff;
  786. MinuteReport_Log_Filename = CFGData.paths_log_path + NodeId + ".status.minute";
  787. HourReport_Log_OnOff = CFGData.Status_HourReport_Log_OnOff;
  788. HourReport_Append_OnOff = CFGData.Status_HourReport_Append_OnOff;
  789. HourReport_Log_Filename = CFGData.paths_log_path + NodeId + ".status.hour";
  790. // Sanity check
  791. if(NULL != myNETmgr && NULL != myGBUdb) { // If we are fully linked then
  792. Configured = true; // we are now configured.
  793. }
  794. }
  795. void snfLOGmgr::doXHDRs(snfCFGData& CFGData, snfScanData& ScanData) { // XHDR sub routine for LogThisScan()
  796. std::ostringstream O; // Setup the output stream.
  797. const std::string SMTPENDL = "\r\n"; // Make a hard-coded SMTP endline.
  798. // Version header
  799. if(CFGData.XHDRVersion_OnOff) { // If the Version XHDR is on then
  800. O << CFGData.XHDRVersion_Header << ": " // emit the Version XHDR.
  801. << SMTPENDL << "\t" << SNF_ENGINE_VERSION;
  802. if(0 < myPlatformVersion.length()) { // Optional Platform Version.
  803. O << SMTPENDL << "\t" << myPlatformVersion;
  804. }
  805. O << SMTPENDL;
  806. }
  807. // License header
  808. if(CFGData.XHDRLicense_OnOff) { // If the license XHDR is on then
  809. O << CFGData.XHDRLicense_Header << ": " // emit the License XHRD.
  810. << CFGData.node_licenseid
  811. << SMTPENDL;
  812. }
  813. // Rulebase header
  814. if(CFGData.XHDRRulebase_OnOff) { // If the rulebase utc XHDR is on
  815. std::string RBUTC; // then make a string to capture it
  816. O << CFGData.XHDRRulebase_Header << ": " // then emit the rulebase utc XHDR.
  817. << (*myNETmgr).RulebaseUTC(RBUTC)
  818. << SMTPENDL;
  819. }
  820. // Identifier header
  821. if(CFGData.XHDRIdentifier_OnOff) { // If the identifier XHDR is on
  822. O << CFGData.XHDRIdentifier_Header << ": " // then emit the scan identifier.
  823. << ScanData.ScanName
  824. << SMTPENDL;
  825. }
  826. // GBUdb header
  827. if(CFGData.XHDRGBUdb_OnOff) { // If the GBUdb XHDR is on then
  828. O << CFGData.XHDRGBUdb_Header << ": "; // then emit the GBUdb XHDR.
  829. if(!ScanData.FoundSourceIP()) { // If no source was identified
  830. O << "Unknown" // then we emit "Unknown".
  831. << SMTPENDL;
  832. } else { // If the source was identified
  833. O << ScanData.SourceIPRecord().Ordinal << ", " // then we emit the ordial,
  834. << (std::string) cd::IP4Address(ScanData.SourceIPRecord().IP) << ", " // the IP, and then
  835. << ScanData.SourceIPEvaluation // the IP evaluation that was
  836. << SMTPENDL; // sent to the scanner.
  837. }
  838. }
  839. // Result header
  840. if(CFGData.XHDRResult_OnOff) { // If the Result XHDR is on then
  841. O << CFGData.XHDRResult_Header << ": " // emit the scan result code XHDR.
  842. << ScanData.CompositeFinalResult
  843. << SMTPENDL;
  844. }
  845. // Matches header
  846. if(CFGData.XHDRMatches_OnOff) { // If the Matches XHDR is on then
  847. O << CFGData.XHDRMatches_Header << ":" << SMTPENDL; // emit the Matches XHDR with matches.
  848. for(
  849. std::list<snf_match>::iterator iM = ScanData.MatchRecords.begin(); // Loop through the match list
  850. iM != ScanData.MatchRecords.end(); iM++ // one by one.
  851. ) {
  852. snf_match& M = (*iM); // Emit each match record as a
  853. O << "\t" // folded entry in the header.
  854. << M.symbol << "-" // symbol-ruleid-index-endex-flag
  855. << M.ruleid << "-"
  856. << M.index << "-"
  857. << M.endex << "-"
  858. << M.flag
  859. << SMTPENDL;
  860. }
  861. }
  862. // Black header
  863. const int AboveBandRange = 64;
  864. if(
  865. CFGData.XHDRBlack_OnOff && // If the Black XHDR is on and
  866. 0 < ScanData.CompositeFinalResult && // We have a nonzero result and
  867. AboveBandRange > ScanData.CompositeFinalResult && // it is not an above-band code and
  868. !CFGData.TrainingWhiteRuleHandler.isListed( // it is not found in the training
  869. ScanData.CompositeFinalResult) // white list then...
  870. ) {
  871. O << CFGData.XHDRBlack_Header // Emit the Black XHDR.
  872. << SMTPENDL;
  873. }
  874. // White header
  875. if( // If the White XHDR is on and
  876. CFGData.XHDRWhite_OnOff && // the result was listed in the
  877. CFGData.TrainingWhiteRuleHandler.isListed( // training white list then...
  878. ScanData.CompositeFinalResult)
  879. ) {
  880. O << CFGData.XHDRWhite_Header // Emit the White XHDR.
  881. << SMTPENDL;
  882. }
  883. // Clean header
  884. if(
  885. CFGData.XHDRClean_OnOff && // If the Clean XHDR is on and
  886. !ScanData.PatternWasFound && // no pattern was found and
  887. 0 == ScanData.CompositeFinalResult // the scan result is zero then...
  888. ) {
  889. O << CFGData.XHDRClean_Header // Emit the Clean XHDR
  890. << SMTPENDL;
  891. }
  892. // Symbol headers
  893. std::string SH = CFGData.XHDRSymbolHeaders.HeaderForSymbol( // Check for a Symbol XHDR
  894. ScanData.CompositeFinalResult // matching this result.
  895. );
  896. if(0 < SH.length()) { // If we have an XHDR for this
  897. O << SH // result then emit the header.
  898. << SMTPENDL;
  899. }
  900. ScanData.XHDRsText = O.str(); // Save the formatted XHeaders.
  901. }
  902. void snfLOGmgr::doXMLLogs(snfCFGData& CFGData, snfScanData& ScanData) { // XML sub routine for LogThisScan()
  903. std::ostringstream O; // Set up the output stream.
  904. bool WeHaveSubordinates = false; // Expect no subordinates at first.
  905. // We do the match sections together because it allows us to scan through
  906. // the match results once and pick up the final result for the <s/> section.
  907. // This way, even if no <m/>atch elements are emitted we will have the
  908. // final result without having to scan the data twice.
  909. // <s/> -- Scan Log Entry (always on if modes is not none)
  910. // <m/> -- Scan Match Entry (controlled by matches attribute)
  911. std::ostringstream R; // Match (R)ecords output.
  912. std::set<int> Duplicates; // Set up to track duplicates.
  913. std::list<snf_match>::iterator MatchRecordsCursor; // Set up a cursor to the results.
  914. for(
  915. MatchRecordsCursor = ScanData.MatchRecords.begin(); // Loop through the scan results
  916. MatchRecordsCursor != ScanData.MatchRecords.end();
  917. MatchRecordsCursor++
  918. ) {
  919. snf_match& M = (*MatchRecordsCursor); // Grab the current match record.
  920. if(
  921. ScanLogMatches_None != CFGData.Scan_XML_Matches && // If match records are requested
  922. ('f' != M.flag && 'c' != M.flag) // and this record is not the (f)inal
  923. ) { // then evaluate it and log (??) it.
  924. if(ScanLogMatches_Unique == CFGData.Scan_Classic_Matches) { // If only unique matches are required
  925. if(Duplicates.end() != Duplicates.find(M.ruleid)) { // check for a duplicate rule id.
  926. continue; // If the rule id was found then skip.
  927. } else { // If the rule id was not found then
  928. Duplicates.insert(M.ruleid); // remember it for next time.
  929. }
  930. }
  931. // At this point we've skipped duplicate match records, but we
  932. // still want to emit some (all?) of them so it's time to do it.
  933. // <m s='48' r='1234567' i='2394' e='2409' f='m'/>
  934. R << "\t<m "
  935. << "s=\'" << M.symbol << "\' "
  936. << "r=\'" << M.ruleid << "\' "
  937. << "i=\'" << M.index << "\' "
  938. << "e=\'" << M.endex << "\' "
  939. << "f=\'" << M.flag << "\'/>"
  940. << std::endl;
  941. } else
  942. if('f' == M.flag || 'c' == M.flag) { // If this record is final, emit it!
  943. WeHaveSubordinates = (
  944. ((ScanLogMatches_None != CFGData.Scan_XML_Matches)
  945. && ('f' == M.flag)) ||
  946. (true == CFGData.Scan_XML_GBUdb) ||
  947. (true == CFGData.Scan_XML_Performance)
  948. );
  949. // <s u='20070508012349' m='msg0123456789.msg' s='48' r='1234567' >
  950. O << "<s " // Format the <s>can element
  951. << "u=\'" << Timestamp(ScanData.StartOfJobUTC) << "\' "
  952. << "m=\'" << ScanData.ScanName << "\' "
  953. << "s=\'" << M.symbol << "\' "
  954. << "r=\'" << M.ruleid << "\'"
  955. << ((WeHaveSubordinates)? ">" : "/>")
  956. << std::endl;
  957. }
  958. }
  959. if(ScanLogMatches_None != CFGData.Scan_XML_Matches) O << R.str(); // Emit the match records if any.
  960. // <p/> -- Scan Performance Monitoring (performance='yes')
  961. // <p s='10' t='8' l='3294' d='84'/>
  962. if(CFGData.Scan_XML_Performance) { // Post performance data if needed.
  963. O << "\t<p "
  964. << "s=\'" << ScanData.SetupTime << "\' "
  965. << "t=\'" << ScanData.ScanTime.getElapsedTime() << "\' "
  966. << "l=\'" << ScanData.ScanSize << "\' "
  967. << "d=\'" << ScanData.ScanDepth << "\'/>"
  968. << std::endl;
  969. }
  970. // <g/> -- GBUdb Activity For This Scan (gbudb='yes')
  971. // <g o='1' i='101.201.31.04' t='u' c='0.12345' p='0.3342983' r='Caution'/>
  972. if(CFGData.Scan_XML_GBUdb && ScanData.FoundSourceIP()) { // Post gbudb data if needed & ready.
  973. O << "\t<g "
  974. << "o=\'" << ScanData.SourceIPRecord().Ordinal << "\' "
  975. << "i=\'" << (std::string) cd::IP4Address(ScanData.SourceIPRecord().IP) << "\' "
  976. << "t=\'" <<
  977. ((Ugly == ScanData.SourceIPRecord().GBUdbData.Flag())? "u" :
  978. ((Good == ScanData.SourceIPRecord().GBUdbData.Flag())? "g" :
  979. ((Bad == ScanData.SourceIPRecord().GBUdbData.Flag())? "b" : "i")))
  980. << "\' "
  981. << "c=\'" << ScanData.SourceIPRecord().GBUdbData.Confidence() << "\' "
  982. << "p=\'" << ScanData.SourceIPRecord().GBUdbData.Probability() << "\' "
  983. << "r=\'" <<
  984. ((Unknown == ScanData.SourceIPRange())? "Unknown" :
  985. ((White == ScanData.SourceIPRange())? "White" :
  986. ((Normal == ScanData.SourceIPRange())? "Normal" :
  987. ((New == ScanData.SourceIPRange())? "New" :
  988. ((Caution == ScanData.SourceIPRange())? "Caution" :
  989. ((Black == ScanData.SourceIPRange())? "Black" :
  990. ((Truncate == ScanData.SourceIPRange())? "Truncate" :
  991. "Fault")))))))
  992. << "\'/>"
  993. << std::endl;
  994. }
  995. // If this wasn't a one-liner then we need to close the <s/> element
  996. if(WeHaveSubordinates) O << "</s>" << std::endl; // If <s> was open then close it.
  997. ScanData.XMLLogText = O.str(); // Save the formatted log text.
  998. // Now that we've produced the appropriate log entries let's send them
  999. // out to the log file.
  1000. if(LogOutputMode_File == CFGData.Scan_XML_Mode) { // If we are writing to file,
  1001. std::string TFN = CFGData.paths_log_path; // build an appropriate log file
  1002. TFN.append(CFGData.node_licenseid); // name.
  1003. if(CFGData.Scan_XML_Rotate) { // If we're rotating per day:
  1004. TFN.append("."); // Put a timestamp on the file name.
  1005. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1006. else { Timestamp(TFN); } // the utc timestamp as configured.
  1007. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1008. }
  1009. TFN.append(".log.xml"); // Tack on the extension.
  1010. XMLScanLogger.post(ScanData.XMLLogText, TFN); // Post the log with the file name.
  1011. }
  1012. }
  1013. void snfLOGmgr::doClassicLogs(snfCFGData& CFGData, snfScanData& ScanData) { // Classic sub routine for LogThisScan()
  1014. std::ostringstream O; // Set up the output stream.
  1015. std::set<int> Duplicates; // Set up to track duplicates.
  1016. std::list<snf_match>::iterator MatchRecordsCursor; // Set up a cursor to the results.
  1017. for(
  1018. MatchRecordsCursor = ScanData.MatchRecords.begin(); // Loop through the scan results
  1019. MatchRecordsCursor != ScanData.MatchRecords.end();
  1020. MatchRecordsCursor++
  1021. ) {
  1022. snf_match& M = (*MatchRecordsCursor); // Grab the current match record.
  1023. if(
  1024. ScanLogMatches_None != CFGData.Scan_Classic_Matches && // If match records are requested
  1025. ('f' != M.flag && 'c' != M.flag) // and this record is not the (f)inal
  1026. ) { // then evaluate it and log (??) it.
  1027. if(ScanLogMatches_Unique == CFGData.Scan_Classic_Matches) { // If only unique matches are required
  1028. if(Duplicates.end() != Duplicates.find(M.ruleid)) { // check for a duplicate rule id.
  1029. continue; // If the rule id was found then skip.
  1030. } else { // If the rule id was not found then
  1031. Duplicates.insert(M.ruleid); // remember it for next time.
  1032. }
  1033. }
  1034. // At this point we've skipped duplicate match records, but we
  1035. // still want to emit some (all?) of them so it's time to do it.
  1036. O << CFGData.node_licenseid << "\t"
  1037. << Timestamp(ScanData.StartOfJobUTC) << "\t"
  1038. << ScanData.ScanName << "\t"
  1039. << ScanData.SetupTime << "\t"
  1040. << ScanData.ScanTime.getElapsedTime() << "\t"
  1041. << (('m' == M.flag) ? "Match\t" :
  1042. (('w' == M.flag) ? "White\t" :
  1043. (('p' == M.flag) ? "Panic\t" : "Fault\t")))
  1044. << M.ruleid << "\t"
  1045. << M.symbol << "\t"
  1046. << M.index << "\t"
  1047. << M.endex << "\t"
  1048. << ScanData.ScanDepth
  1049. << std::endl;
  1050. } else { // If this record is final, emit it!
  1051. O << CFGData.node_licenseid << "\t"
  1052. << Timestamp(ScanData.StartOfJobUTC) << "\t"
  1053. << ScanData.ScanName << "\t"
  1054. << ScanData.SetupTime << "\t"
  1055. << ScanData.ScanTime.getElapsedTime() << "\t"
  1056. << (('f' == M.flag) ? "Final\t" :
  1057. (('c' == M.flag) ? "Clean\t" : "Fault\t"))
  1058. << M.ruleid << "\t"
  1059. << M.symbol << "\t"
  1060. << M.index << "\t"
  1061. << M.endex << "\t"
  1062. << ScanData.ScanDepth
  1063. << std::endl;
  1064. }
  1065. }
  1066. ScanData.ClassicLogText = O.str(); // Save the formatted log text.
  1067. // Now that we've produced the appropriate log entries let's send them
  1068. // out to the log file.
  1069. if(LogOutputMode_File == CFGData.Scan_Classic_Mode) { // If we are writing to file,
  1070. std::string TFN = CFGData.paths_log_path; // build an appropriate log file
  1071. TFN.append(CFGData.node_licenseid); // name.
  1072. if(CFGData.Scan_Classic_Rotate) { // If we're rotating per day:
  1073. TFN.append("."); // Put a timestamp on the file name.
  1074. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1075. else { Timestamp(TFN); } // the utc timestamp as configured.
  1076. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1077. }
  1078. TFN.append(".log"); // Tack on the extension.
  1079. ClassicScanLogger.post(ScanData.ClassicLogText, TFN); // Post the log with the file name.
  1080. }
  1081. }
  1082. //// LogThisScan() is broken into two sections. The first section happens with
  1083. //// the snfLOGmgr mutex locked and must happen as quickly as possible so that
  1084. //// the chance for contention over those resources is minimized. This amounts
  1085. //// to some raw CPU work adjusting counters and so forth.
  1086. ////
  1087. //// The second section handles any additional work such as formatting log
  1088. //// entries. Essentially, anything that doesn't NEED to happen while the mutex
  1089. //// is locked should happen in the second section.
  1090. ////
  1091. //// The two subroutines for LogThisScan are:
  1092. //// captureLTSMetrics() -- Mutex locked, first section
  1093. //// performLTSLogging() -- Mutex NOT locked, second section
  1094. void snfLOGmgr::captureLTSMetrics(snfCFGData& CFGData, snfScanData& ScanData) { // LogThisScan section 1
  1095. cd::ScopeMutex FreezeRightThereWhileITakeThisPicture(MyMutex); // Lock the object for this update.
  1096. if(Status.LatestRuleID < ScanData.PatternID) { // If we have a new latest rule id
  1097. Status.LatestRuleID = ScanData.PatternID; // then capture it.
  1098. }
  1099. // keep histograms---
  1100. // Second, Minute, and Hour histograms are reset() by the appropriate
  1101. // reporting functions. That is, when a Second report is made, the Second
  1102. // histograms are reset; likewise Minutes and Hours. As a result we simply
  1103. // hit them all the same way when we log a scan.
  1104. ResultsSecond.hit(ScanData.CompositeFinalResult); // Histogram the result codes.
  1105. ResultsMinute.hit(ScanData.CompositeFinalResult);
  1106. ResultsHour.hit(ScanData.CompositeFinalResult);
  1107. if(ScanData.PatternWasFound) { // Histogram pattern IDs.
  1108. RulesSecond.hit(ScanData.PatternID);
  1109. RulesMinute.hit(ScanData.PatternID);
  1110. RulesHour.hit(ScanData.PatternID);
  1111. }
  1112. if(0 < ScanData.RulePanics.size()) { // Histogram any rule panic hits.
  1113. std::set<int>::iterator iP;
  1114. for( // Dump the set of rule panic
  1115. iP = ScanData.RulePanics.begin(); // IDs from beginning to end
  1116. iP != ScanData.RulePanics.end(); // into our histogram set.
  1117. iP++) {
  1118. PanicsSecond.hit((*iP));
  1119. PanicsMinute.hit((*iP));
  1120. PanicsHour.hit((*iP));
  1121. }
  1122. }
  1123. // count up these things---
  1124. ++(*CurrentCounters).Events.Scans; // Number of messages scanned.
  1125. const int HamResult = 0; // A result of 0 is "clean" or "white"
  1126. if( // If we have identified Ham
  1127. HamResult == ScanData.CompositeFinalResult || // either by the conventional result or
  1128. CFGData.TrainingWhiteRuleHandler.isListed(ScanData.CompositeFinalResult) // some known white-rule symbol
  1129. ) {
  1130. ++(*CurrentCounters).Events.Ham; // then we will bump the Ham counter.
  1131. } else { // For any other result we will bump
  1132. ++(*CurrentCounters).Events.Spam; // the spam counter.
  1133. }
  1134. if(ScanData.GBUdbNormalTriggered) { // Count of GBUdb indetermineta IPs.
  1135. ++(*CurrentCounters).Events.GBUdbNormalTriggered;
  1136. }
  1137. if(ScanData.GBUdbWhiteTriggered) { // Count of GBUdb found source IP white.
  1138. ++(*CurrentCounters).Events.GBUdbWhiteTriggered;
  1139. }
  1140. if(ScanData.GBUdbWhiteSymbolForced) { // Count of white was on and symbol was set.
  1141. ++(*CurrentCounters).Events.GBUdbWhiteSymbolForced;
  1142. }
  1143. if(ScanData.GBUdbPatternSourceConflict) { // Count of pattern was found with white IP.
  1144. ++(*CurrentCounters).Events.GBUdbPatternSourceConflict;
  1145. }
  1146. if(ScanData.GBUdbAutoPanicTriggered) { // Count of autopanic was triggered.
  1147. ++(*CurrentCounters).Events.GBUdbAutoPanicTriggered;
  1148. }
  1149. if(ScanData.GBUdbAutoPanicExecuted) { // Count of an autopanic was added.
  1150. ++(*CurrentCounters).Events.GBUdbAutoPanicExecuted;
  1151. }
  1152. if(ScanData.GBUdbBlackTriggered) { // Count of GBUdb found source IP black.
  1153. ++(*CurrentCounters).Events.GBUdbBlackTriggered;
  1154. }
  1155. if(ScanData.GBUdbBlackSymbolForced) { // Count of black was on and symbol was set.
  1156. ++(*CurrentCounters).Events.GBUdbBlackSymbolForced;
  1157. }
  1158. if(ScanData.GBUdbTruncateTriggered) { // Count of Truncate was possible.
  1159. ++(*CurrentCounters).Events.GBUdbTruncateTriggered;
  1160. }
  1161. if(ScanData.GBUdbPeekTriggered) { // Count of we could peek.
  1162. ++(*CurrentCounters).Events.GBUdbPeekTriggered;
  1163. }
  1164. if(ScanData.GBUdbSampleTriggered) { // Count of we could sample.
  1165. ++(*CurrentCounters).Events.GBUdbSampleTriggered;
  1166. }
  1167. if(ScanData.GBUdbTruncateExecuted) { // Count of if we actually did truncate.
  1168. ++(*CurrentCounters).Events.GBUdbTruncateExecuted;
  1169. }
  1170. if(ScanData.GBUdbPeekExecuted) { // Count of we peeked instead of truncating.
  1171. ++(*CurrentCounters).Events.GBUdbPeekExecuted;
  1172. }
  1173. if(ScanData.GBUdbSampleExecuted) { // Count of we sampled.
  1174. ++(*CurrentCounters).Events.GBUdbSampleExecuted;
  1175. }
  1176. if(ScanData.GBUdbCautionTriggered) { // Count of GBUdb found source IP suspicous.
  1177. ++(*CurrentCounters).Events.GBUdbCautionTriggered;
  1178. }
  1179. if(ScanData.GBUdbCautionSymbolForced) { // Count of caution was on and symbol was set.
  1180. ++(*CurrentCounters).Events.GBUdbCautionSymbolForced;
  1181. }
  1182. if(ScanData.PatternWasFound) { // Count of scanner matches.
  1183. ++(*CurrentCounters).Events.PatternWasFound;
  1184. }
  1185. if(0 < ScanData.RulePanics.size()) { // Count of rule panics.
  1186. ++(*CurrentCounters).Events.RulePanicFound;
  1187. }
  1188. }
  1189. void snfLOGmgr::performLTSLogging(snfCFGData& CFGData, snfScanData& ScanData) { // LogThisScan section 2
  1190. // Build X- Headers, XML Log, and Classic Log as needed...
  1191. if(LogOutputMode_None != CFGData.XHDROutput_Mode) { // If XHeaders are turned on then
  1192. doXHDRs(CFGData, ScanData); // call the XHeaders subroutine.
  1193. }
  1194. if(LogOutputMode_None != CFGData.Scan_XML_Mode) { // If XML scan logs are turned on then
  1195. doXMLLogs(CFGData, ScanData); // call the XML scan log subroutine.
  1196. }
  1197. if(LogOutputMode_None != CFGData.Scan_Classic_Mode) { // If Classic scan logs are turned on
  1198. doClassicLogs(CFGData, ScanData); // then call the Classic log subroutine.
  1199. }
  1200. }
  1201. void snfLOGmgr::logThisScan(snfCFGData& CFGData, snfScanData& ScanData) { // How to log a scan event...
  1202. captureLTSMetrics(CFGData, ScanData); // Lock the mutex and do the math.
  1203. performLTSLogging(CFGData, ScanData); // Unlock the mutex and write it down.
  1204. if(0 < ScanData.XHDRsText.length()) { // If we have XHeader data then
  1205. switch(CFGData.XHDROutput_Mode) { // set the appropriate output mode.
  1206. case LogOutputMode_Inject: ScanData.XHeaderInjectOn = true; break; // We will either inject the headers
  1207. case LogOutputMode_File: ScanData.XHeaderFileOn = true; break; // or we will create a .xhdr file.
  1208. } // The actual inject/file operation
  1209. } // happens in ScanMessageFile().
  1210. ScanData.ReadyToClear = true; // This can be cleared now once
  1211. } // the ScanData has been consumed.
  1212. // logThisError(CFGData, ScanData) - for scanning errors (message context)
  1213. void snfLOGmgr::logThisError(snfScanData& ScanData, const std::string ContextName, // Inject an error log entry for this
  1214. const int Code, const std::string Text // scan using this number & message.
  1215. ) {
  1216. // Check for each type of log and create an appropriate entry for
  1217. // each log type that is activated in the configuration.
  1218. //// Handle XML Log Scan Error Reports
  1219. if(LogOutputMode_None != XML_Log_Mode) { // If XML logs are on emit the error.
  1220. // Produce Error Log Entry and store in XMLLogText
  1221. std::stringstream O; // Stringstream for formatting.
  1222. O << "<e " // Format the <s>can error element
  1223. << "u=\'" << Timestamp(ScanData.StartOfJobUTC) << "\' "
  1224. << "context=\'" << ContextName << "\' "
  1225. << "m=\'" << ScanData.ScanName << "\' "
  1226. << "code=\'" << Code << "\' "
  1227. << "text=\'" << Text << "\'"
  1228. << "/>"
  1229. << std::endl;
  1230. ScanData.XMLLogText = O.str(); // Save the formatted log text.
  1231. // Now that we've produced the appropriate log entries let's send them
  1232. // out to the log file.
  1233. if(LogOutputMode_File == XML_Log_Mode) { // If we are writing to file,
  1234. std::string TFN = LogsPath; // build an appropriate log file
  1235. TFN.append(NodeId); // name.
  1236. if(XMLLogRotate) { // If we're rotating per day:
  1237. TFN.append("."); // Put a timestamp on the file name.
  1238. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1239. else { Timestamp(TFN); } // the utc timestamp as configured.
  1240. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1241. }
  1242. TFN.append(".log.xml"); // Tack on the extension.
  1243. XMLScanLogger.post(ScanData.XMLLogText, TFN); // Post the log with the file name.
  1244. }
  1245. }
  1246. //// Handle Clasic Log Scan Error Reports
  1247. if(LogOutputMode_None != Classic_Log_Mode) { // If Classic logs are on emit the error.
  1248. // Produce an appropriate Error log entry in ClassicLogText
  1249. std::stringstream O; // Stringstream for formatting.
  1250. O << NodeId << "\t" // Format the scan error entry.
  1251. << Timestamp(ScanData.StartOfJobUTC) << "\t"
  1252. << ScanData.ScanName << "\t"
  1253. << ScanData.SetupTime << "\t"
  1254. << ScanData.ScanTime.getElapsedTime() << "\t"
  1255. << Text << "\t"
  1256. << "0\t"
  1257. << Code << "\t"
  1258. << "0\t"
  1259. << ScanData.ScanSize << "\t"
  1260. << ScanData.ScanDepth
  1261. << std::endl;
  1262. ScanData.ClassicLogText = O.str(); // Save the formatted log text.
  1263. // Now that we've produced the appropriate log entries let's send them
  1264. // out to the log file.
  1265. if(LogOutputMode_File == Classic_Log_Mode) { // If we are writing to file,
  1266. std::string TFN = LogsPath; // build an appropriate log file
  1267. TFN.append(NodeId); // name.
  1268. if(ClassicLogRotate) { // If we're rotating per day:
  1269. TFN.append("."); // Put a timestamp on the file name.
  1270. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1271. else { Timestamp(TFN); } // the utc timestamp as configured.
  1272. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1273. }
  1274. TFN.append(".log"); // Tack on the extension.
  1275. ClassicScanLogger.post(ScanData.ClassicLogText, TFN); // Post the log with the file name.
  1276. }
  1277. }
  1278. }
  1279. // logThisIPTest w/ Action
  1280. void snfLOGmgr::logThisIPTest(IPTestRecord& I, std::string Action) { // Log an IPTest and action.
  1281. if(!Configured) return; // Do nothing if not configured.
  1282. std::stringstream O; // Stringstream to format the entry.
  1283. std::string tmp; // String for use getting timestamp.
  1284. O << "<t "
  1285. << "u=\'" << Timestamp(tmp) << "\' "
  1286. << "ip=\'" << (std::string) I.IP << "\' "
  1287. << "t=\'" <<
  1288. ((Ugly == I.G.Flag())? "u" :
  1289. ((Good == I.G.Flag())? "g" :
  1290. ((Bad == I.G.Flag())? "b" : "i")))
  1291. << "\' "
  1292. << "g=\'" << I.G.Good() << "\' "
  1293. << "b=\'" << I.G.Bad() << "\' "
  1294. << "c=\'" << I.G.Confidence() << "\' "
  1295. << "p=\'" << I.G.Probability() << "\' "
  1296. << "r=\'" <<
  1297. ((Unknown == I.R)? "Unknown" :
  1298. ((White == I.R)? "White" :
  1299. ((Normal == I.R)? "Normal" :
  1300. ((New == I.R)? "New" :
  1301. ((Caution == I.R)? "Caution" :
  1302. ((Black == I.R)? "Black" :
  1303. ((Truncate == I.R)? "Truncate" :
  1304. "Fault")))))))
  1305. << "\' "
  1306. << "a=\'" << Action << "\'"
  1307. << "/>" << std::endl;
  1308. XMLScanLogger.post(O.str()); // Post the log, use existing path.
  1309. }
  1310. // logThisError(Context, Code, Text) - for non-message errors.
  1311. void snfLOGmgr::logThisError(
  1312. std::string ContextName, int Code, std::string Text) { // Log an error message.
  1313. if(!Configured) return; // Do nothing if not configured.
  1314. cd::ScopeMutex LockCFG(MyMutex); // Don't change CFG. I'm using it!
  1315. if(LogOutputMode_File == XML_Log_Mode) { // If XML logs are turned on:
  1316. std::stringstream O; // Stringstream to format the entry.
  1317. std::string tmp; // String for use getting timestamp.
  1318. O << "<e " // Format an <e/>rror element.
  1319. << "u=\'" << Timestamp(tmp) << "\' "
  1320. << "context=\'" << ContextName << "\' "
  1321. << "code=\'" << Code << "\' "
  1322. << "text=\'" << Text << "\'/>"
  1323. << std::endl;
  1324. // Now that we've produced the appropriate log entries let's send them
  1325. // out to the log file.
  1326. std::string TFN = LogsPath; // build an appropriate log file
  1327. TFN.append(NodeId); // name.
  1328. if(XMLLogRotate) { // If we're rotating per day:
  1329. TFN.append("."); // Put a timestamp on the file name.
  1330. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1331. else { Timestamp(TFN); } // the utc timestamp as configured.
  1332. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1333. }
  1334. TFN.append(".log.xml"); // Tack on the extension.
  1335. XMLScanLogger.post(O.str(), TFN); // Post the log with the file name.
  1336. }
  1337. if(LogOutputMode_File == Classic_Log_Mode) { // If Classic logs are turned on:
  1338. std::stringstream O; // Stringstream to format the entry.
  1339. std::string tmp; // String for use getting timestamp.
  1340. O << NodeId << "\t" // Format the error entry.
  1341. << Timestamp(tmp) << "\t"
  1342. << ContextName << "\t"
  1343. << "0\t"
  1344. << "0\t"
  1345. << Text << "\t"
  1346. << "0\t"
  1347. << Code << "\t"
  1348. << "0\t"
  1349. << "0\t"
  1350. << "0\t"
  1351. << std::endl;
  1352. // Now that we've produced the appropriate log entries let's send them
  1353. // out to the log file.
  1354. std::string TFN = LogsPath; // build an appropriate log file
  1355. TFN.append(NodeId); // name.
  1356. if(ClassicLogRotate) { // If we're rotating per day:
  1357. TFN.append("."); // Put a timestamp on the file name.
  1358. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1359. else { Timestamp(TFN); } // the utc timestamp as configured.
  1360. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1361. }
  1362. TFN.append(".log"); // Tack on the extension.
  1363. ClassicScanLogger.post(O.str(), TFN); // Post the log with the file name.
  1364. }
  1365. }
  1366. // logThisInfo(Context, Code, Text) - for generic non-errors.
  1367. void snfLOGmgr::logThisInfo(
  1368. std::string ContextName, int Code, std::string Text) { // Log an informational message.
  1369. if(!Configured) return; // Do nothing if not configured.
  1370. cd::ScopeMutex LockCFG(MyMutex); // Don't change CFG. I'm using it!
  1371. if(LogOutputMode_File == XML_Log_Mode) { // If XML logs are turned on:
  1372. std::stringstream O; // Stringstream to format the entry.
  1373. std::string tmp; // String for use getting timestamp.
  1374. O << "<i " // Format an <i/>nfo element.
  1375. << "u=\'" << Timestamp(tmp) << "\' "
  1376. << "context=\'" << ContextName << "\' "
  1377. << "code=\'" << Code << "\' "
  1378. << "text=\'" << Text << "\'/>"
  1379. << std::endl;
  1380. // Now that we've produced the appropriate log entries let's send them
  1381. // out to the log file.
  1382. std::string TFN = LogsPath; // build an appropriate log file
  1383. TFN.append(NodeId); // name.
  1384. if(XMLLogRotate) { // If we're rotating per day:
  1385. TFN.append("."); // Put a timestamp on the file name.
  1386. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1387. else { Timestamp(TFN); } // the utc timestamp as configured.
  1388. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1389. }
  1390. TFN.append(".log.xml"); // Tack on the extension.
  1391. XMLScanLogger.post(O.str(), TFN); // Post the log with the file name.
  1392. }
  1393. if(LogOutputMode_File == Classic_Log_Mode) { // If Classic logs are turned on:
  1394. std::stringstream O; // Stringstream to format the entry.
  1395. std::string tmp; // String for use getting timestamp.
  1396. O << NodeId << "\t" // Format the informational entry.
  1397. << Timestamp(tmp) << "\t"
  1398. << ContextName << "\t"
  1399. << "0\t"
  1400. << "0\t"
  1401. << Text << "\t"
  1402. << "0\t"
  1403. << Code << "\t"
  1404. << "0\t"
  1405. << "0\t"
  1406. << "0\t"
  1407. << std::endl;
  1408. // Now that we've produced the appropriate log entries let's send them
  1409. // out to the log file.
  1410. std::string TFN = LogsPath; // build an appropriate log file
  1411. TFN.append(NodeId); // name.
  1412. if(ClassicLogRotate) { // If we're rotating per day:
  1413. TFN.append("."); // Put a timestamp on the file name.
  1414. if(Rotate_LocalTime) { LocalTimestamp(TFN); } // Use either the local timestamp or
  1415. else { Timestamp(TFN); } // the utc timestamp as configured.
  1416. TFN = TFN.substr(0, TFN.length() - 6); // Stip off the Hours, Minutes, Seconds.
  1417. }
  1418. TFN.append(".log"); // Tack on the extension.
  1419. ClassicScanLogger.post(O.str(), TFN); // Post the log with the file name.
  1420. }
  1421. }
  1422. std::string snfLOGmgr::PlatformVersion(std::string NewPlatformVersion) { // Set platform version info.
  1423. cd::ScopeMutex FreezeForNewData(MyMutex); // Get the ball and
  1424. myPlatformVersion = NewPlatformVersion; // set the data.
  1425. return myPlatformVersion; // return the new data.
  1426. }
  1427. std::string snfLOGmgr::PlatformVersion() { // Get platform version info.
  1428. cd::ScopeMutex DontChangeOnMe(MyMutex); // Get the ball and
  1429. return myPlatformVersion; // get the data.
  1430. }
  1431. std::string snfLOGmgr::EngineVersion() { // Get engine version info.
  1432. return std::string(SNF_ENGINE_VERSION); // Return the engine version string.
  1433. }
  1434. //// The caller to getSpamshot promises to reset() the counters when it is done
  1435. //// with the data and before getSnapshot() gets called again.
  1436. snfCounterPack* snfLOGmgr::getSnapshot() { // Get a copy of the current counters.
  1437. snfCounterPack* Snapshot = CurrentCounters; // Grab the active counters.
  1438. CurrentCounters = ReportingCounters; // Swap the reporting counters in.
  1439. CurrentCounters->ActiveTime.start(Snapshot->ActiveTime.stop()); // (De)Activate the activity timers.
  1440. ReportingCounters = Snapshot; // Put the old ActiveCounters into
  1441. return Snapshot; // reporting mode and return a ptr.
  1442. }
  1443. bool snfLOGmgr::OkToPeek(int PeekOneInX) { // Test to see if it's ok to peek.
  1444. cd::ScopeMutex JustMe(PeekMutex); // Protect the peek enable counter.
  1445. ++PeekEnableCounter; // Bump the counter by one.
  1446. if(PeekEnableCounter >= PeekOneInX) { // If we've made the threshold then
  1447. PeekEnableCounter = 0; // reset the counter and
  1448. return true; // return true.
  1449. } // If not then
  1450. return false; // return false.
  1451. }
  1452. bool snfLOGmgr::OkToSample(int SampleOneInX) { // Test to see if it's ok to sample.
  1453. cd::ScopeMutex JustMe(SampleMutex); // Protect the sample enable counter.
  1454. ++SampleEnableCounter; // Bump the counter by one.
  1455. if(SampleEnableCounter >= SampleOneInX) { // If we've made the threshold then
  1456. SampleEnableCounter = 0; // reset the counter and
  1457. return true; // return true.
  1458. } // If not then return
  1459. return false; // false.
  1460. }
  1461. time_t snfLOGmgr::Timestamp() { // Get an ordinary timestamp.
  1462. time_t rawtime;
  1463. rawtime = time(NULL);
  1464. return rawtime;
  1465. }
  1466. std::string snfLOGmgr::Timestamp(time_t t) { // Convert time_t to a timestamp s.
  1467. std::stringstream TimestampBfr;
  1468. const std::string EmptyTimestamp = "00000000000000";
  1469. std::string theTimeStamp = EmptyTimestamp;
  1470. tm* gmt; // Get a ptr to a tm structure.
  1471. gmt = gmtime(&t); // Fill it with UTC.
  1472. bool isValidGMT = (0 != gmt);
  1473. if(isValidGMT) {
  1474. TimestampBfr
  1475. << std::setw(4) << (gmt->tm_year+1900)
  1476. << std::setw(2) << std::setfill('0') << (gmt->tm_mon+1)
  1477. << std::setw(2) << std::setfill('0') << (gmt->tm_mday)
  1478. << std::setw(2) << std::setfill('0') << (gmt->tm_hour)
  1479. << std::setw(2) << std::setfill('0') << (gmt->tm_min)
  1480. << std::setw(2) << std::setfill('0') << (gmt->tm_sec)
  1481. ;
  1482. theTimeStamp = TimestampBfr.str();
  1483. }
  1484. return theTimeStamp; // Return a string.
  1485. }
  1486. std::string& snfLOGmgr::Timestamp(std::string& s) { // Returns a current timestamp in s.
  1487. s.append(Timestamp(Timestamp())); // Append the timestamp to s and
  1488. return s; // return it.
  1489. }
  1490. cd::RuntimeCheck LocalTimestampGoodTimestampLength("snfLOGmgr.cpp:LocalTimestamp snprintf(...) == CorrectTimestampLength");
  1491. std::string snfLOGmgr::LocalTimestamp(time_t t) { // Convert time_t to a local timestamp s.
  1492. char TimestampBfr[16]; // Create a small buffer.
  1493. tm* localt; // Get a ptr to a tm structure.
  1494. localt = localtime(&t); // Fill it with local time.
  1495. size_t l = snprintf( // Format yyyymmddhhmmss
  1496. TimestampBfr, sizeof(TimestampBfr),
  1497. "%04d%02d%02d%02d%02d%02d",
  1498. localt->tm_year+1900,
  1499. localt->tm_mon+1,
  1500. localt->tm_mday,
  1501. localt->tm_hour,
  1502. localt->tm_min,
  1503. localt->tm_sec
  1504. );
  1505. const size_t CorrectTimestampLength = 4+2+2+2+2+2;
  1506. LocalTimestampGoodTimestampLength(l == CorrectTimestampLength);
  1507. return std::string(TimestampBfr); // Return a string.
  1508. }
  1509. std::string& snfLOGmgr::LocalTimestamp(std::string& s) { // Returns a local timestamp in s.
  1510. s.append(LocalTimestamp(Timestamp())); // Append the timestamp to s and
  1511. return s; // return it.
  1512. }
  1513. unsigned int snfLOGmgr::SerialNumber() { // Returns the next serial number.
  1514. cd::ScopeMutex AtomicOperation(SerialNumberMutex); // Lock the serial number mutex.
  1515. ++Status.SerialNumberCounter; // Increment the serial number.
  1516. unsigned int result = Status.SerialNumberCounter; // Capture the new value.
  1517. return result; // Return the unique result.
  1518. }
  1519. std::string& snfLOGmgr::SerialNumber(std::string& s) { // Appends the next serial number.
  1520. char SerialNumberBuffer[9]; // 8 hex digits and a null terminator.
  1521. sprintf( // Format the serial number and
  1522. SerialNumberBuffer, // place it into the buffer.
  1523. "%08X", SerialNumber()
  1524. );
  1525. s.append(SerialNumberBuffer); // Append the buffer to s.
  1526. return s; // Return s.
  1527. }
  1528. // Persistent State Functions
  1529. // The Persistent State object is slightly smart. It won't try to restore
  1530. // itself from disk if it has already been restored. It won't write itself
  1531. // to disk unless it was first loaded or there was no original file to load.
  1532. // This leaves open the possibility that a disk problem when opening the
  1533. // engine could cause a persistent state problem - but the alternative is to
  1534. // have the persistent state unprotected. If there is a problem, then clearing
  1535. // the problem and re-opening the engine will load the persistent state. If
  1536. // that's not the best solution then it's always possible to destroy the
  1537. // existing persistent state and start over -- at least then it will be a
  1538. // conscious decision and not a "side effect"
  1539. void snfLOGPersistentState::store(std::string& FileNameToStore) { // Write the whole thing to a file.
  1540. if(Ready) { // If it is safe to overwrite then
  1541. try { // Try... to
  1542. std::ofstream P(
  1543. FileNameToStore.c_str(), std::ios::trunc | std::ios::binary); // Open and overwrite the file and
  1544. P.write((char*)this, sizeof(snfLOGPersistentState)); // store our bytes in binary format.
  1545. P.close();
  1546. } catch (...) {} // Ignore any errors for now.
  1547. }
  1548. }
  1549. void snfLOGPersistentState::restore(std::string& FileNameToRestore) { // Read the whole thing from a file.
  1550. if(!Ready) { // If we have not already loaded...
  1551. if(0 > access(FileNameToRestore.c_str(), R_OK)) { // If the file cannot be read we
  1552. Ready = true; // will assume it doesn't exist and
  1553. } // set our Ready flag to allow writing.
  1554. else { // If the file does exist we load it.
  1555. try { // Try this...
  1556. std::ifstream P(FileNameToRestore.c_str(), std::ios::binary); // Create a binary input stream and
  1557. P.read((char*)this, sizeof(snfLOGPersistentState)); // read the bytes into this object.
  1558. P.close(); // Then, close the file.
  1559. Ready = true; // Set the Ready flag to allow writes.
  1560. } catch(...) {} // Ignore any errors for now.
  1561. }
  1562. }
  1563. }
  1564. // 20090730_M - Moved persistent state aux saves to RecordSyncEvent. It makes
  1565. // sense for the persistent state to match the latext external record of state
  1566. // info. If SNFServer dies uncerimoneusly that is what we will remember.
  1567. int snfLOGmgr::SecsSinceStartup() {
  1568. return (int) difftime(Timestamp(), StartupTime);
  1569. }
  1570. void snfLOGmgr::RecordSyncEvent() { // Sets timestamp of latest Sync.
  1571. Status.LastSyncTime = Timestamp(); // Set the Sync time.
  1572. if(Configured) Status.store(PersistentFileName); // Store our persistent data.
  1573. }
  1574. int snfLOGmgr::SecsSinceLastSync() { // Gets seconds since latest Sync.
  1575. return (int) difftime(Timestamp(), Status.LastSyncTime);
  1576. }
  1577. void snfLOGmgr::RecordSaveEvent() { // Sets timestamp of latest Save.
  1578. Status.LastSaveTime = Timestamp();
  1579. }
  1580. int snfLOGmgr::SecsSinceLastSave() { // Gets seconds since latest Save.
  1581. return (int) difftime(Timestamp(), Status.LastSaveTime);
  1582. }
  1583. void snfLOGmgr::RecordCondenseEvent() { // Sets timestamp of latest Condense.
  1584. Status.LastCondenseTime = Timestamp();
  1585. }
  1586. int snfLOGmgr::SecsSinceLastCondense() { // Gets seconds since latest Condense.
  1587. return (int) difftime(Timestamp(), Status.LastCondenseTime);
  1588. }
  1589. // Data in the multi-range sliding window is tracked in circular buffers.
  1590. // The snf_SMHDMY_Counter::do_input() function encapsuates the input operation.
  1591. bool snf_SMHDMY_Counter::do_input( // Subroutine for new data input.
  1592. int X, // Given new data X,
  1593. int& SUM, // the SUM being tracked,
  1594. int* DATA, // the array of DATA,
  1595. int& ORDINAL, // the current ORDINAL,
  1596. int SIZE) { // and the SIZE of the array...
  1597. SUM -= DATA[ORDINAL]; // Subtract the old data from the
  1598. SUM += (DATA[ORDINAL] = X); // SUM and replace it with X.
  1599. ++ORDINAL; // Move to the next slot and
  1600. if(SIZE <= ORDINAL) ORDINAL = 0; // rotate back around if needed.
  1601. return (0 == ORDINAL); // Return true if time to carry.
  1602. }
  1603. void snf_SMHDMY_Counter::input(int X) {
  1604. if(do_input(X, SEC6SUM, SEC6DATA, SEC6ORDINAL, 6)) // 6 second sum
  1605. if(do_input(SEC6SUM, SEC10SUM, SEC10DATA, SEC10ORDINAL, 10)) // 60 second sum
  1606. if(do_input(SEC10SUM, MIN6SUM, MIN6DATA, MIN6ORDINAL, 6)) // 6 minute sum
  1607. if(do_input(MIN6SUM, MIN10SUM, MIN10DATA, MIN10ORDINAL, 10)) // 60 minute sum
  1608. if(do_input(MIN10SUM, HOUR4SUM, HOUR4DATA, HOUR4ORDINAL, 4)) // 4 hour sum
  1609. if(do_input(HOUR4SUM, HOUR6SUM, HOUR6DATA, HOUR6ORDINAL, 6)) { // 24 hour sum
  1610. do_input(HOUR6SUM, WEEK7SUM, WEEK7DATA, WEEK7ORDINAL, 7); // 7 day sum
  1611. do_input(HOUR6SUM, YEAR365SUM, YEAR365DATA, YEAR365ORDINAL, 365); // 365 day sum
  1612. if(do_input(HOUR6SUM, MONTH5SUM, MONTH5DATA, MONTH5ORDINAL, 5)) // 5 day sum
  1613. if(do_input(MONTH5SUM, MONTH6SUM, MONTH6DATA, MONTH6ORDINAL, 6)) // 30 day sum
  1614. if(do_input(MONTH6SUM, YEAR3SUM, YEAR3DATA, YEAR3ORDINAL, 3)) // 3 month sum
  1615. do_input(YEAR3SUM, YEAR4SUM, YEAR4DATA, YEAR4ORDINAL, 4); // 12 month sum
  1616. }
  1617. }
  1618. double snf_SMHDMY_AveragePerMinute( // Get mornalized minute avg of X
  1619. snf_SMHDMY_Counter& X, // Input the Units in the period.
  1620. snf_SMHDMY_Counter& M) { // Input the Milliseconds in the period.
  1621. int Units = X.SEC6SUM + X.SEC10SUM; // Get the count.
  1622. int Milliseconds = M.SEC6SUM + M.SEC10SUM; // Get the time.
  1623. return snf_rationalize(Units, Milliseconds, MillisecondsInAMinute); // Normalize to a minute.
  1624. }
  1625. double snfLOGmgr::MessagesPerMinute() { // Avg Msgs/Minute.
  1626. return snf_SMHDMY_AveragePerMinute(MessageCounter, TimeCounter);
  1627. }
  1628. double snfLOGmgr::HamPerMinute() { // Avg Ham/Minute.
  1629. return snf_SMHDMY_AveragePerMinute(HamCounter, TimeCounter);
  1630. }
  1631. double snfLOGmgr::SpamPerMinute() { // Avg Spam/Minute.
  1632. return snf_SMHDMY_AveragePerMinute(SpamCounter, TimeCounter);
  1633. }
  1634. double snfLOGmgr::WhitePerMinute() { // Avg White/Minute.
  1635. return snf_SMHDMY_AveragePerMinute(WhiteCounter, TimeCounter);
  1636. }
  1637. double snfLOGmgr::CautionPerMinute() { // Avg Caution/Minute.
  1638. return snf_SMHDMY_AveragePerMinute(CautionCounter, TimeCounter);
  1639. }
  1640. double snfLOGmgr::BlackPerMinute() { // Avg Black/Minute.
  1641. return snf_SMHDMY_AveragePerMinute(BlackCounter, TimeCounter);
  1642. }
  1643. double snfLOGmgr::TruncatePerMinute() { // Avg Truncate/Minute.
  1644. return snf_SMHDMY_AveragePerMinute(TruncateCounter, TimeCounter);
  1645. }
  1646. double snfLOGmgr::SamplePerMinute() { // Avg Sample/Minute.
  1647. return snf_SMHDMY_AveragePerMinute(SampleCounter, TimeCounter);
  1648. }
  1649. const std::string EmptyStatusSecondReport = "<stats class=\'second\'/>"; // Empty Status.Second looks like this.
  1650. std::string snfLOGmgr::getStatusSecondReport() { // Get latest status.second report.
  1651. cd::ScopeMutex FlashBulb(StatusReportMutex); // Take a safe snapshot of the report.
  1652. if(0 < SecondReportText.length()) return SecondReportText; // If it's posted then send it. If not
  1653. return EmptyStatusSecondReport; // then send the empty version.
  1654. }
  1655. const std::string EmptyStatusMinuteReport = "<stats class=\'minute\'/>"; // Empty Status.Minute looks like this.
  1656. std::string snfLOGmgr::getStatusMinuteReport() { // Get latest status.minute report.
  1657. cd::ScopeMutex FlashBulb(StatusReportMutex); // Take a safe snapshot of the report.
  1658. if(0 < MinuteReportText.length()) return MinuteReportText; // If it's posted then send it. If not
  1659. return EmptyStatusMinuteReport; // then send the empty version.
  1660. }
  1661. const std::string EmptyStatusHourReport = "<stats class=\'hour\'/>"; // Empty Status.Hour looks like this.
  1662. std::string snfLOGmgr::getStatusHourReport() { // Get latest status.hour report.
  1663. cd::ScopeMutex FlashBulb(StatusReportMutex); // Take a safe snapshot of the report.
  1664. if(0 < HourReportText.length()) return HourReportText; // If it's posted then send it. If not
  1665. return EmptyStatusHourReport; // then send the empty version.
  1666. }