Extract events from a System.log file
(SystemLogPath, Year, Bzip2ed=False, Gziped=False)
| 1235 | |
| 1236 | |
| 1237 | def ParseSystemlogFile(SystemLogPath, Year, Bzip2ed=False, Gziped=False): |
| 1238 | ''' Extract events from a System.log file ''' |
| 1239 | |
| 1240 | global HTML_EVENTS_LANES |
| 1241 | global HTML_EVENTS_ITEMS |
| 1242 | global HTML_EVENTS_LANES_CPT |
| 1243 | AllEvents = [] |
| 1244 | SystemLogData = '' |
| 1245 | |
| 1246 | PrintAndLog(SystemLogPath, 'DEBUG') |
| 1247 | |
| 1248 | if Gziped: |
| 1249 | try: |
| 1250 | with gzip.open(SystemLogPath, 'rb') as SystemLogFile: |
| 1251 | SystemLogData = SystemLogFile.read() |
| 1252 | except: |
| 1253 | PrintAndLog('Failed to open ' + SystemLogPath.decode('utf-8'), 'ERROR') |
| 1254 | else: |
| 1255 | try: |
| 1256 | with open(SystemLogPath, 'r') as SystemLogFile: |
| 1257 | SystemLogData = SystemLogFile.read() |
| 1258 | if Bzip2ed: SystemLogData = bz2.decompress(SystemLogData) |
| 1259 | except: |
| 1260 | PrintAndLog('Failed to open ' + SystemLogPath.decode('utf-8'), 'ERROR') |
| 1261 | |
| 1262 | DateRegex = '^(?P<date>\w{3}\s{1,2}\d{1,2}\s[\d:]{8})' |
| 1263 | |
| 1264 | BootTimesRegExp = re.compile(DateRegex + '.+BOOT_TIME', re.MULTILINE) |
| 1265 | ShutDownTimesRegExp = re.compile(DateRegex + '.+\sSHUTDOWN_TIME', re.MULTILINE) |
| 1266 | |
| 1267 | HibernationInTimesLRegExp = re.compile(DateRegex + '.+\sPMScheduleWakeEventChooseBest', re.MULTILINE) #Lion |
| 1268 | HibernationInTimesMLRegExp = re.compile(DateRegex + '.+\shibernate_setup\(0\)\stook', re.MULTILINE) #Mountain Lion |
| 1269 | HibernationOutTimesLRegExp = re.compile(DateRegex + '.+\sMessage\sWake', re.MULTILINE) #Lion TOFIX (in SYSLOG) |
| 1270 | HibernationOutTimesMLRegExp = re.compile(DateRegex + '.+\sWake\sreason', re.MULTILINE) #Mountain Lion |
| 1271 | |
| 1272 | LockedSessionsLRegExp = re.compile(DateRegex + '.+\sloginwindow', re.MULTILINE) #Lion |
| 1273 | LockedSessionsMLRegExp = re.compile(DateRegex + '.+\sApplication\sApp:\'loginwindow\'', re.MULTILINE) #Mountain Lion |
| 1274 | |
| 1275 | SessionsUnlockFailRegExp = re.compile(DateRegex + '.+\sThe\sauthtok\sis\sincorrect', re.MULTILINE) #Lion and Mountain Lion |
| 1276 | SessionsUnlockOkRegExp = re.compile(DateRegex + '.+\Establishing\scredentials', re.MULTILINE) #Lion and Mountain Lion |
| 1277 | |
| 1278 | SudosOkRegExp = re.compile(DateRegex + '.+\ssudo\[\d+\]:\s+(?P<sudo>.+)$', re.MULTILINE) #Lion and Mountain Lion |
| 1279 | SudosFailRegExp = re.compile(DateRegex + '.+\sincorrect\spassword\sattempts', re.MULTILINE) #Lion and Mountain Lion |
| 1280 | |
| 1281 | USBKernelRegExp = re.compile(DateRegex + '.+\sUSBMSC\sIdentifier.+:\s(?P<serial>[a-zA-Z0-9]+)\s', re.MULTILINE) #Lion and Mountain Lion |
| 1282 | FsEventRegExp = re.compile(DateRegex + '.+\sfseventsd.+log\sdir:\s(?P<volume>/Volumes/.+)\.fseventsd getting\snew\suuid:\s(?P<uuid>.+)$', re.MULTILINE) #Lion and Mountain Lion |
| 1283 | |
| 1284 | HFSMountRegExp = re.compile(DateRegex + '.+\shfs:\smounted\s(?P<mountpoint>.+)$', re.MULTILINE) #Lion and Mountain Lion |
| 1285 | |
| 1286 | TTYOpenedRegExp = re.compile(DateRegex + '.+\sUSER_PROCESS:\s\d+\sttys', re.MULTILINE) #Lion and Mountain Lion |
| 1287 | TTYClosedRegExp = re.compile(DateRegex + '.+\sDEAD_PROCESS:\s\d+\sttys', re.MULTILINE) #Lion and Mountain Lion |
| 1288 | |
| 1289 | NetUPKernelRegExp = re.compile(DateRegex + '.+\skernel\[\d\+]:\sEthernet.+Link\up', re.MULTILINE) #Lion and Mountain Lion |
| 1290 | NetChangeLRegExp = re.compile(DateRegex + '.+\sconfigd\[\d+]:\snetwork\sconfiguration\schanged', re.MULTILINE) #Lion |
| 1291 | NetChangeMLRegExp = re.compile(DateRegex + '.+\sconfigd\[\d+]:\snetwork\schanged:', re.MULTILINE) #Mountain Lion |
| 1292 | |
| 1293 | BootTimes = BootTimesRegExp.findall(SystemLogData) |
| 1294 | for Item in BootTimes: AllEvents.append([Item, 'Boot', 1]) |
no test coverage detected