secwatch.c

Go to the documentation of this file.

/*----------------------------------------------------------------------------
 secwatch - Copyright (C) 2006 Nic Stevens -- See COPYING for license details
------------------------------------------------------------------------------
 secwatch.c - This is the code for the main loop of secwatch. Here we pull log
 data, a line at time, and test it against the patterns (in pattern.c) We also
 do simple signal handling here (flush IP list and exit)
-----------------------------------------------------------------------------*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <errno.h>
#include "log.h"
#include "strutil.h"
#include "tail.h"
#include "configfile.h"

void sigHandler() {
     writeIpList();
     exit(0);
}
void secwatch(void) {
     char buf[32767];
     char ip[32];
     char *filename;
     int ipp;
     loadIpList();
     signal(SIGINT,sigHandler);
     signal(SIGKILL,sigHandler);
     signal(SIGABRT,sigHandler);
     signal(SIGTERM,sigHandler);
     writeLog("secwatch startup");
     while(1) {
          ipManage();
          if(taildata(&filename,buf,sizeof(buf)) > 0) {
               if(patternMatch(filename,buf,&ipp) == 0) {
                    if(sscanf(&buf[ipp],"%s",ip)) 
                         incrementHitCount(ip);
                    else
                         writeLog("Couldn't get ip from log line: [%s]",trim(buf));
               }
               processLogHooks(buf);
          }
          tailsleep(100);
     }
}

---