logconfigure.java

syslog接收ids告警使用sax解析转换为idmef存入数据库

package logToMySQL;

import java.util.*;
import javax.xml.parsers.*;
import org.xml.sax.*;
import org.xml.sax.helpers.DefaultHandler;

public class LogConfigure {
	private static List<List<String>> regexes = new ArrayList<List<String>>();
	private static boolean existConfig = true;
	private static final String configFile = "config.xml";
	
	static {
		for (int i=0;i<IDMEF.values().length;i++) {
			regexes.add(new ArrayList<String>());
		}
	}
	
	public static boolean isConfig() {
		return existConfig;
	}

	public static void loadConfig(){
		try {
			existConfig = readConfig();
		}catch(Exception ex){
			existConfig = false;
			ex.printStackTrace();
		}
	}
	
	public static List<String> getRuleList(IDMEF i) {
		return regexes.get(i.ordinal());
	}
	
	private static boolean readConfig() throws Exception{
		SAXParserFactory factory = SAXParserFactory.newInstance();
    	SAXParser saxParser = factory.newSAXParser();

    	DefaultHandler handler = new DefaultHandler() {
    		IDMEF i;
    		public void startElement(String uri, String localName,
            String qName, Attributes attribs) throws SAXException {
    			if (qName.equalsIgnoreCase("match")) {
    				//System.out.println(attribs.getValue("regex"));
    				LogConfigure.getRuleList(i).add(attribs.getValue("regex"));
    			}
    			if (qName.equalsIgnoreCase("parser")) {
    				i = IDMEF.strToIDMEF(attribs.getValue("name"));
    			}
    		} 
     };
     	saxParser.parse(configFile, handler);
	    return true;
	}
}