auditlogger.cpp

Pegasus is an open-source implementationof the DMTF CIM and WBEM standards. It is designed to be por

    const CIMObjectPath& instanceName,
    const String& moduleName,
    const String& providerName,
    CIMStatusCode statusCode)
{
    if (providerName != String::EMPTY)
    {
        MessageLoaderParms msgParms(
            "Common.AuditLogger.OPERATION_UPDATE_INSTANCE_WITH_PROVIDER",
            "A CIM $0 operation on instance \"$1\" in namespace \"$2\" by "
                "user \"$3\" connected from system \"$4\" resulted in "
                "status \"$5\".  "
                "The provider for this operation is \"$6\" in module \"$7\".",
            cimMethodName,
            CIMObjectPath("", CIMNamespaceName(), instanceName.getClassName(),
                instanceName.getKeyBindings()).toString(),
            nameSpace.getString(),
            userName,
            ipAddr,
            cimStatusCodeToString(statusCode),
            providerName,
            moduleName);

        _writeAuditMessageToFile(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
            eventType, Logger::INFORMATION, msgParms);
    }
    else
    {
        MessageLoaderParms msgParms(
            "Common.AuditLogger.OPERATION_UPDATE_INSTANCE",
            "A CIM $0 operation on instance \"$1\" in namespace \"$2\" by "
                "user \"$3\" connected from system \"$4\" resulted in "
                "status \"$5\".  ",
            cimMethodName,
            CIMObjectPath("", CIMNamespaceName(), instanceName.getClassName(),
                instanceName.getKeyBindings()).toString(),
            nameSpace.getString(),
            userName,
            ipAddr,
            cimStatusCodeToString(statusCode));

        _writeAuditMessageToFile(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
            eventType, Logger::INFORMATION, msgParms);
    }
}

void AuditLogger::logInvokeMethodOperation(
    const String& userName,
    const String& ipAddr,
    const CIMNamespaceName& nameSpace,
    const CIMObjectPath& objectName,
    const CIMName& methodName,
    const String& moduleName,
    const String& providerName,
    CIMStatusCode statusCode)
{
    if (providerName != String::EMPTY)
    {
        MessageLoaderParms msgParms(
            "Common.AuditLogger.OPERATION_INVOKE_METHOD_WITH_PROVIDER",
            "A CIM InvokeMethod operation on method \"$0\" of object \"$1\" "
                "in namespace \"$2\" by user \"$3\" connected from system "
                "\"$4\" resulted in status \"$5\".  The provider for this "
                "operation is \"$6\" in module \"$7\".",
            methodName.getString(),
            CIMObjectPath("", CIMNamespaceName(), objectName.getClassName(),
                objectName.getKeyBindings()).toString(),
            nameSpace.getString(),
            userName,
            ipAddr,
            cimStatusCodeToString(statusCode),
            providerName,
            moduleName);

        _writeAuditMessageToFile(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
            EVENT_INVOKE, Logger::INFORMATION, msgParms);
    }
    else
    {
        MessageLoaderParms msgParms(
            "Common.AuditLogger.OPERATION_INVOKE_METHOD",
            "A CIM InvokeMethod operation on method \"$0\" of object \"$1\" "
                "in namespace \"$2\" by user \"$3\" connected from system "
                "\"$4\" resulted in status \"$5\".",
            methodName.getString(),
            CIMObjectPath("", CIMNamespaceName(), objectName.getClassName(),
                objectName.getKeyBindings()).toString(),
            nameSpace.getString(),
            userName,
            ipAddr,
            cimStatusCodeToString(statusCode));

        _writeAuditMessageToFile(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
            EVENT_INVOKE, Logger::INFORMATION, msgParms);
    }
}

void AuditLogger::logUpdateProvModuleStatus(
    const String & moduleName,
    const Array<Uint16> currentModuleStatus,
    const Array<Uint16> newModuleStatus)
{
    String currentModuleStatusValue =
        _getModuleStatusValue(currentModuleStatus);

    String newModuleStatusValue = _getModuleStatusValue(newModuleStatus);

    MessageLoaderParms msgParms(
        "Common.AuditLogger.UPDATE_PROVIDER_MODULE_STATUS",
        "The operational status of module \"$0\" has changed from \"$1\""
        " to \"$2\".",
        moduleName, currentModuleStatusValue, newModuleStatusValue);

    _writeAuditMessageToFile(TYPE_CONFIGURATION,
        SUBTYPE_PROVIDER_MODULE_STATUS_CHANGE,
        EVENT_UPDATE, Logger::INFORMATION, msgParms);
}

void AuditLogger::logLocalAuthentication(
        const String& userName,
        Boolean successful)
{
    CIMValue result(successful);

    MessageLoaderParms msgParms(
       "Common.AuditLogger.LOCAL_AUTHENTICATION",
       "Local authentication attempt: "
       "successful = $0, user = $1. ",
       result.toString(),
       userName);

    _writeAuditMessageToFile(
        TYPE_AUTHENTICATION,
        SUBTYPE_LOCAL_AUTHENTICATION,
        successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
        successful ? Logger::INFORMATION : Logger::WARNING,
        msgParms);
}

void AuditLogger::logBasicAuthentication(
        const String& userName,
        const String& ipAddr,
        Boolean successful)
{
    CIMValue result(successful);

    MessageLoaderParms msgParms(
       "Common.AuditLogger.BASIC_AUTHENTICATION",
       "Basic authentication attempt: "
       "successful = $0, user = $1, IP address = $2.",
       result.toString(),
       userName,
       ipAddr);

    _writeAuditMessageToFile( TYPE_AUTHENTICATION,
        SUBTYPE_BASIC_AUTHENTICATION,
        successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
        successful ? Logger::INFORMATION: Logger::WARNING,
        msgParms);
}

void AuditLogger::setInitializeCallback(
    PEGASUS_AUDITLOGINITIALIZE_CALLBACK_T auditLogInitializeCallback)
{
    _auditLogInitializeCallback = auditLogInitializeCallback;
}

void AuditLogger::setEnabled(Boolean enabled)
{
    // Only write the enable/disable messages if we are set up to handle them
    if (_auditLogInitializeCallback != 0)
    {
        if (enabled)
        {
            if (!_auditLogFlag)
            {
                _auditLogInitializeCallback();

                MessageLoaderParms msgParms(
                    "Common.AuditLogger.ENABLE_AUDIT_LOG",
                    "Audit logging is enabled.");

                _writeAuditMessageToFile(TYPE_CONFIGURATION,
                    SUBTYPE_CONFIGURATION_CHANGE,
                    EVENT_UPDATE, Logger::INFORMATION, msgParms);
            }
        }
        else
        {
            if (_auditLogFlag)
            {
                MessageLoaderParms msgParms(
                    "Common.AuditLogger.DISABLE_AUDIT_LOG",
                    "Audit logging is disabled.");

                _writeAuditMessageToFile(TYPE_CONFIGURATION,
                    SUBTYPE_CONFIGURATION_CHANGE,
                    EVENT_UPDATE, Logger::INFORMATION, msgParms);
            }
        }
    }

    _auditLogFlag = enabled;
}

void AuditLogger::writeAuditLogToFileCallback(
    PEGASUS_AUDITLOG_CALLBACK_T writeAuditLogToFileCallback)
{
    _writeAuditMessageToFile = writeAuditLogToFileCallback;
}

void AuditLogger::_writeAuditMessage(
    AuditType auditType,
    AuditSubType auditSubType,
    AuditEvent auditEvent,
    Uint32 logLevel,
    MessageLoaderParms & msgParms)
{
    String localizedMsg = MessageLoader::getMessage(msgParms);

    String identifier = "cimserver audit";

    Logger::put(Logger::AUDIT_LOG, identifier, logLevel, localizedMsg);
}

String AuditLogger::_getModuleStatusValue(
    const Array<Uint16>  moduleStatus)
{
    String moduleStatusValue, statusValue;
    Uint32 moduleStatusSize = moduleStatus.size();

    for (Uint32 j=0; j < moduleStatusSize; j++)
    {
        statusValue = providerModuleStatus[moduleStatus[j]];
        moduleStatusValue.append(statusValue);

        if (j < moduleStatusSize - 1)
        {
            moduleStatusValue.append(",");
        }
    }

    return moduleStatusValue;
}

PEGASUS_NAMESPACE_END

#endif