secwatch.c File Reference

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <errno.h>
#include "log.h"
#include "strutil.h"
#include "tail.h"
#include "configfile.h"

Include dependency graph for secwatch.c:

Go to the source code of this file.

Functions
void	sigHandler ()
void	secwatch (void)

---

Function Documentation

void secwatch (  void   )

secwatch watches log files looking for repeat attemps based on patterns if secwatch thinks an external source is making too many failed attemps that source's packets will be dropped for a specified time. Definition at line 34 of file secwatch.c. References incrementHitCount(), ipManage(), loadIpList(), patternMatch(), processLogHooks(), sigHandler(), taildata(), tailsleep(), trim(), and writeLog(). { char buf[32767]; char ip[32]; char *filename; int ipp; loadIpList(); signal(SIGINT,sigHandler); signal(SIGKILL,sigHandler); signal(SIGABRT,sigHandler); signal(SIGTERM,sigHandler); writeLog("secwatch startup"); while(1) { ipManage(); if(taildata(&filename,buf,sizeof(buf)) > 0) { if(patternMatch(filename,buf,&ipp) == 0) { if(sscanf(&buf[ipp],"%s",ip)) incrementHitCount(ip); else writeLog("Couldn't get ip from log line: [%s]",trim(buf)); } processLogHooks(buf); } tailsleep(100); } } Here is the call graph for this function:

void sigHandler (   )

flush the IP list to disk on a signal and exit. Definition at line 25 of file secwatch.c. References writeIpList(). Referenced by secwatch(). { writeIpList(); exit(0); } Here is the call graph for this function:

---