Subversion Repositories sysadmin_scripts

#! /usr/bin/env perl

# script to process samba audit log, storing summary of information

# for future processing.

# will read $summaryFile into memory, if it exists, then scan

# $auditFile, adding new entries.

# will then write results back to $summaryFile (making a backup first)

# resulting file is a tab delimited text file, where each line begins

# with three standard fields; username, timestamp and IP.

# the remaining fields are actions based on %headers below (other actions

# are ignored).

#

# NOTE: timestamp is floor'd to the nearest day, ie int(timestamp/86400)*86400

# as we want to summarize a days activity.

use strict;

use warnings;

use Parse::Syslog;

# apt-get install libparse-syslog-perl

# path to Samba audit file

my $auditFile = '/var/log/samba/audit.log.1';

# path to our historical summary file

my $summaryFile = '/opt/sambaAudit/samba_audit.summary';

# hash to store all our activity

my %activity;

# hash containing the action headers we care about

my %headers = ( 'mkdir' => 1, 'pread' => 1, 'pwrite' => 1,'rmdir' => 1,'unlink' => 1 );

# number of seconds in a day, 86400. BREAKS on Daylight Savings Time

my $secondsInDay = 60*60*24;

# function loads the summary file into %activity

# also modified %headers, based on the headers it finds in the summary file

sub loadSummary {

   open SUMMARY,"<$summaryFile" or return;

   #print STDERR "Loading summary file\n";

   # file exists, so read in the first line, which is the headers

   my $line = <SUMMARY>;

   chomp $line;

   my @headers = split( "\t", $line );

   # replace our preset ones with whatever headers we have here

   %headers = map{ $_ => 1 } @headers;

   # the following are not actions, so remove them from the headers

   delete @headers{qw(user day ip)};

   # read each line and create the activity.

   # note that user, timestamp and IP are required to be in the first

   # three columns

   while ( $line = <SUMMARY> ) {

      chomp $line;

      my @data = split( "\t", $line );

      for ( my $i = 3; $i < @headers; $i++ ) {

         $activity{$data[0]}{$data[1]}{$data[2]}{$headers[$i]} = $data[$i];

      }

   }

   close SUMMARY;

}

sub mailLog {

   my $from = 'rodo@dailydata.net';

   my $to = 'rodo@dailydata.net';

   my $server = 'smtp.dailydata.net:587';

   my $smtpuser = 'rodo@dailydata.net';

   my $smtppass = 'naught/nice3';

   `/opt/sendEmail/sendEmail.pl -f '$from' -t '$to' -u 'Samba Audit Log' -s 'smtp.dailydata.net:587' -a /opt/sambaAudit/samba_audit.summary -xu '$smtpuser' -xp '$smtppass' -l /tmp/sendemail.log -m 'Attached is the tab delimited file from the audit log'`;

}

# get our summary file into the access hash

&loadSummary();

# use Parse::Syslog to read in each line, mainly to get the timestamp

my $parser = Parse::Syslog->new( $auditFile );

while ( my $sl = $parser->next ) {

   # remove the time from it; just date

   my $timestamp = int( $sl->{'timestamp'} / $secondsInDay ) * $secondsInDay;

   # text contains the information we care about

   my @temp = split( '\|', $sl->{'text'} );

   # and we only care about the first three of them, which are user, ip

   # and the action they took

   my ( $user, $ip, $action ) = @temp[0..2];

   # update %activity if this is an action we track

   $activity{$user}{$timestamp}{$ip}{$action}++ if $headers{$action};

}

# make a backup of the summary file, if it exists

unlink "$summaryFile~" if -e "$summaryFile~";

rename $summaryFile, "$summaryFile~" if -e $summaryFile;

# and overwrite it

open SUMMARY, ">$summaryFile" or die "Could not save summary file $summaryFile: $!\n";

my @line; # the line we'll build for output

# header line

print SUMMARY "user\tday\tip\t" . join( "\t", sort keys %headers ) . "\n";

# process each user

foreach my $user ( sort keys %activity ) {

   push @line, $user;

   my $timestamp = $activity{$user};

   # process the date

   foreach my $time ( sort keys %$timestamp ) {

      push @line, $time;

      my $ips = $$timestamp{$time};

      # and the time

      foreach my $ip ( sort keys %$ips ) {

         push @line, $ip;

         my $actions = $$ips{$ip};

         # Finally, get the actions (all of them)

         foreach my $action ( sort keys %headers ) {

            push @line, $$actions{$action} ? $$actions{$action} : 0;

         }

         # finished with all the actions, so dump the line

         print SUMMARY join( "\t", @line ) . "\n";

         # and delete all the actions for a new IP

         delete @line[2..$#line];

      } # ip

      # delete the IP also for a new timestamp

      delete @line[1..$#line];

   } # timestamp

   # completely reset @line for a new user

   @line = ();

} # user

close SUMMARY;

&mailLog();

1;