logreader.java

syslog接收ids告警使用sax解析转换为idmef存入数据库

package logToMySQL;

import java.util.*;
import org.apache.oro.text.regex.*;

public class LogReader {
	static final MySQL_Writer sqlWriter = new MySQL_Writer();
	public static boolean existConfig;
	
	public LogReader() {
		existConfig = LogConfigure.isConfig();
		if (!existConfig) {
			System.out.println("Error in read configure!");
		}
	}
	
	public void processNewLog(String log){
		MessageSTL idmefMess = new MessageSTL();

		if (existConfig) {
			for (IDMEF i:IDMEF.values()) {
				process(log, LogConfigure.getRuleList(i), idmefMess, i);
			}
			sqlWriter.write(idmefMess);
		}
	}
	
	public static void process(String log, List<String> rules, MessageSTL idmefMess, IDMEF i) {
		Iterator<String> ri = rules.iterator();
		while (ri.hasNext()) {
			String ruleStr = ri.next();
			String attrib = getMatch(log,ruleStr,1);

			if ( attrib != null ) {
				idmefMess.setMessage(attrib, i);
				break;
			}
		}
	}
	
	public static String getMatch(String str,String regex,int group) {
		String result = null;
		try {
			PatternCompiler compiler = new Perl5Compiler();
			Pattern pattern = compiler.compile(regex,Perl5Compiler.CASE_INSENSITIVE_MASK);
			PatternMatcher matcher = new Perl5Matcher();
			if (matcher.contains(str,pattern)) {
				MatchResult rslt = matcher.getMatch();
				result = rslt.group(group);
			}
		}catch(Exception ex){
			ex.printStackTrace();
		}
		//System.out.println(str+"!"+regex+"!"+result);
		return result;
	}
}