a
=*f'2 @ s0 d Z dZdZddlZddlZddlmZ ddlmZm Z m
Z
dd l m Z e e
Zed
Zed d fZed
ZedZedZedZedZedZedZeddd fZedZedZedZ edej Z G dd d e Z G d d d e Z!G d d d e Z"G d!d" d"e Z#dS )#z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL N)abstractmethod )reGroupDictStrptimetimeREgetTimePatternRE ) getLoggerz (?/ r z(^(?:\(\?\w+\))?(?:\^|\((?:\?:)?\^(?!\|))z(? r@
default_tzr
r
r getDate s zDateTemplate.getDatec
C s$ t dtdtdtd| S )Nr )RE_EXEANC_BOUND_BEGr$ RE_EXSANC_BOUND_BEGRE_EXLINE_BOUND_BEGRE_EXLINE_NO_BOUNDS)patternr
r
r unboundPattern s
zDateTemplate.unboundPattern)TT)NN)__name__
__module__ __qualname____doc__r* r. r) r, r r r6 propertyr3 r= rA r rE staticmethodrK r
r
r
r r 9 s"
@ r c @ s$ e Zd ZdZdddZd ddZdS )
DateEpochzA date template which searches for Unix timestamps.
This includes Unix timestamps which appear at start of a line, optionally
within square braces (nsd), or on SELinux audit log lines.
Attributes
----------
name
regex
FNc s t | |sdn|| _|| _d| _d |r>|s4dn|| _d |r~t fdd|}t|sld| d }d
| _| | n4|sd }| j |d d
nd }| j |ddd d S )NZEpochr z\d{10,11}\b(?:\.\d{3,6})?Z LongEpochz'\d{10,11}(?:\d{3}(?:\.\d{1,6}|\d{3})?)?c s d S )Nz(%s)r
)vZepochREr
r r r z$DateEpoch.__init__..()r zf((?:^|(?P(?<=^\[))|(?P(?<=\baudit\()))%s)(?:(?(selinux)(?=:\d+\)))|(?(square)(?=\])))Fr4 z*((?P(?<=^\[))?%s)(?(square)(?=\]))r T)r4 r5 )
r r r _longFrm_grpIdxRE_EPOCH_PATTERNr$ r' r# r6 )r Z
lineBeginOnlyrJ ZlongFrmr3 r
rT r r s&
zDateEpoch.__init__c C sn |s| |}|rj|| j}| jr^t|dkr^t|dkrRd|vrRt|d }n t|d }t||fS dS )ax Method to return the date for a log line.
Parameters
----------
line : str
Log line, of which the date should be extracted from.
default_tz: ignored, Unix timestamps are time zone independent
Returns
-------
(float, str)
Tuple containing a Unix timestamp, and the string of the date
which was matched and in turned used to calculated the timestamp.
.i@B i N)rA r
rY rX lenfloat)r r> r@ rD rS r
r
r rE s
zDateEpoch.getDate)FNF)NNrL rM rN rO r rE r
r
r
r rR s
rR c sh e Zd ZdZe \ZZeeZd
fdd Z e
dd Z e j dd Z d fd d
Z
dd d Z ZS )DatePatternRegexzDate template, with regex/pattern
Parameters
----------
pattern : str
Sets the date templates pattern.
Attributes
----------
name
regex
pattern
Nc s2 t t| d | _|d ur.| j|fi | d S r )superra r _patternr6 )r rJ kwargs __class__r
r r ! s zDatePatternRegex.__init__c C s | j S )aV The pattern used for regex with strptime "%" time fields.
This should be a valid regular expression, of which matching string
will be extracted from the log line. strptime style "%" fields will
be replaced by appropriate regular expressions, or custom regex
groups with names as per the strptime fields can also be used
instead.
)rc r r
r
r rJ ' s
zDatePatternRegex.patternc C s | | d S r )r6 )r rJ r
r
r rJ 3 s Tc
s || _ t|r$td|}d }}|rBt|rBtd|}d}zL| jd|}|| j | _|t }t |rxd| }t
t | ||| W n4 t
y } z td||f W Y d }~n
d }~0 0 d S )Nr Fr z%(\1)sz(?iu)zWFailed to set datepattern '%s' (may be an invalid format or unescaped percent char): %s)rc rI r# r$ rH
_patternRE _patternNamer r RE_ALPHA_PATTERNrb ra r6 r: TypeError)r rJ r4 r5 fmtr3 r< re r
r r6 7 s
zDatePatternRegex.setRegexc C s* |s| |}|r&t| |d|fS dS )a Method to return the date for a log line.
This uses a custom version of strptime, using the named groups
from the instances `pattern` property.
Parameters
----------
line : str
Log line, of which the date should be extracted from.
default_tz: optionally used to correct timezone
Returns
-------
(float, str)
Tuple containing a Unix timestamp, and the string of the date
which was matched and in turned used to calculated the timestamp.
)rD N)rA r groupdictrC r
r
r rE N s
zDatePatternRegex.getDate)N)TT)NN)rL rM rN rO r rg rh r8 r9 r rP rJ setterr6 rE
__classcell__r
r
re r ra s
ra c @ s$ e Zd ZdZdddZd ddZdS )
DateTai64nz_A date template which matches TAI64N format timestamps.
Attributes
----------
name
regex
Fc C s" t | d| _| jd|d d S )NZTAI64Nz
@[0-9a-f]{24}rW )r r r r6 )r r4 r
r
r r p s
zDateTai64n.__init__Nc C s: |s| |}|r6|d}|dd }t|d|fS dS )aq Method to return the date for a log line.
Parameters
----------
line : str
Log line, of which the date should be extracted from.
default_tz: ignored, since TAI is time zone independent
Returns
-------
(float, str)
Tuple containing a Unix timestamp, and the string of the date
which was matched and in turned used to calculated the timestamp.
r r r\ N)rA r
int)r r> r@ rD valueZseconds_since_epochr
r
r rE v s
zDateTai64n.getDate)F)NNr` r
r
r
r ro g s
ro )$
__author__Z
__copyright__Z __license__r8 r abcr strptimer r r Zhelpersr rL r1 r9 r' r( r" rI rH rG rF r% r& r0 r- r/ ri
IGNORECASErZ objectr rR ra ro r
r
r
r s8
?X