Skip to content

Commit 2491548

Browse files
joschijoschi
committed
Add support for FortiGate syslog events
1 parent 69a6f75 commit 2491548

File tree

2 files changed

+210
-0
lines changed

2 files changed

+210
-0
lines changed

‎src/main/java/org/graylog2/syslog4j/server/impl/event/FortiGateSyslogEvent.java‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
package org.graylog2.syslog4j.server.impl.event;
2+
3+
import org.graylog2.syslog4j.server.SyslogServerEventIF;
4+
5+
import java.nio.charset.Charset;
6+
import java.nio.charset.StandardCharsets;
7+
import java.time.LocalDate;
8+
import java.time.LocalTime;
9+
import java.time.ZoneOffset;
10+
import java.time.ZonedDateTime;
11+
import java.time.format.DateTimeFormatter;
12+
import java.util.Collections;
13+
import java.util.Date;
14+
import java.util.HashMap;
15+
import java.util.Map;
16+
import java.util.regex.Matcher;
17+
import java.util.regex.Pattern;
18+
19+
import static java.util.Objects.requireNonNull;
20+
21+
/**
22+
* FortiGateSyslogEvent provides an implementation of the
23+
* SyslogServerEventIF interface that supports receiving of
24+
* FortiGate/FortiOS syslog messages.
25+
*
26+
* @see <a href="http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-logging-reporting-54/logs.htm#Log_messages">FortiGate logging and reporting overview</a>
27+
*/
28+
public class FortiGateSyslogEvent implements SyslogServerEventIF {
29+
private static final Pattern PRI_PATTERN = Pattern.compile("^<(\\d{1,3})>(.*)$");
30+
private static final Pattern KV_PATTERN = Pattern.compile("(\\w+)=([^\\s\"]*)");
31+
private static final Pattern QUOTED_KV_PATTERN = Pattern.compile("(\\w+)=\"([^\"]*)\"");
32+
33+
private final String rawEvent;
34+
private Date date;
35+
private int facility;
36+
private int level;
37+
private String host;
38+
private String message;
39+
private Charset charSet = StandardCharsets.UTF_8;
40+
private Map<String, String> fields = Collections.emptyMap();
41+
42+
public FortiGateSyslogEvent(final String rawEvent) {
43+
this.rawEvent = requireNonNull(rawEvent, "rawEvent");
44+
parse(rawEvent);
45+
}
46+
47+
private void parse(String event) {
48+
final Matcher matcher = PRI_PATTERN.matcher(event);
49+
if (!matcher.find()) {
50+
throw new IllegalArgumentException("Invalid Fortigate syslog message");
51+
} else {
52+
final String priority = matcher.group(1);
53+
final String message = matcher.group(2);
54+
55+
parsePriority(priority);
56+
setMessage(message);
57+
parseFields(message);
58+
parseDate(fields.get("date"), fields.get("time"));
59+
setHost(fields.get("devname"));
60+
}
61+
}
62+
63+
private void parsePriority(String priorityString) {
64+
try {
65+
final int priority = Integer.parseInt(priorityString);
66+
setFacility(priority / 8);
67+
setLevel(priority % 8);
68+
} catch (NumberFormatException e) {
69+
throw new IllegalArgumentException("Couldn't parse message priority", e);
70+
}
71+
}
72+
73+
private void parseFields(String event) {
74+
final Map<String, String> fields = new HashMap<>();
75+
final Matcher matcher = KV_PATTERN.matcher(event);
76+
while (matcher.find()) {
77+
fields.put(matcher.group(1), matcher.group(2));
78+
}
79+
final Matcher quotedMatcher = QUOTED_KV_PATTERN.matcher(event);
80+
while (quotedMatcher.find()) {
81+
fields.put(quotedMatcher.group(1), quotedMatcher.group(2));
82+
}
83+
setFields(fields);
84+
}
85+
86+
private void parseDate(String date, String time) {
87+
if (date != null && time != null) {
88+
final ZonedDateTime dateTime = ZonedDateTime.of(
89+
LocalDate.parse(date, DateTimeFormatter.ISO_LOCAL_DATE.withZone(ZoneOffset.UTC)),
90+
LocalTime.parse(time, DateTimeFormatter.ISO_LOCAL_TIME.withZone(ZoneOffset.UTC)),
91+
ZoneOffset.UTC);
92+
setDate(Date.from(dateTime.toInstant()));
93+
94+
} else {
95+
setDate(new Date());
96+
}
97+
}
98+
99+
@Override
100+
public byte[] getRaw() {
101+
return rawEvent.getBytes(charSet);
102+
}
103+
104+
@Override
105+
public int getFacility() {
106+
return facility;
107+
}
108+
109+
@Override
110+
public void setFacility(int facility) {
111+
this.facility = requireNonNull(facility, "facility");
112+
}
113+
114+
@Override
115+
public Date getDate() {
116+
return date;
117+
}
118+
119+
@Override
120+
public void setDate(Date date) {
121+
this.date = requireNonNull(date, "date");
122+
}
123+
124+
@Override
125+
public int getLevel() {
126+
return level;
127+
}
128+
129+
@Override
130+
public void setLevel(int level) {
131+
this.level = requireNonNull(level, "level");
132+
}
133+
134+
@Override
135+
public String getHost() {
136+
return host;
137+
}
138+
139+
@Override
140+
public void setHost(String host) {
141+
this.host = host;
142+
}
143+
144+
@Override
145+
public boolean isHostStrippedFromMessage() {
146+
return false;
147+
}
148+
149+
@Override
150+
public String getMessage() {
151+
return message;
152+
}
153+
154+
@Override
155+
public void setMessage(String message) {
156+
this.message = requireNonNull(message, "message");
157+
}
158+
159+
@Override
160+
public String getCharSet() {
161+
return charSet.name();
162+
}
163+
164+
@Override
165+
public void setCharSet(String charSet) {
166+
this.charSet = Charset.forName(charSet);
167+
}
168+
169+
public Map<String, String> getFields() {
170+
return Collections.unmodifiableMap(fields);
171+
}
172+
173+
public void setFields(Map<String, String> fields) {
174+
this.fields = requireNonNull(fields, "fields");
175+
}
176+
}

‎src/test/java/org/graylog2/syslog4j/server/impl/event/FortiGateSyslogEventTest.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package org.graylog2.syslog4j.server.impl.event;
2+
3+
import org.junit.Test;
4+
5+
import java.nio.charset.StandardCharsets;
6+
import java.time.ZoneOffset;
7+
import java.time.ZonedDateTime;
8+
9+
import static org.assertj.core.api.Assertions.assertThat;
10+
11+
public class FortiGateSyslogEventTest {
12+
@Test
13+
public void testFortiGateMessage() {
14+
final String rawMessage = "<45>date=2017-03-06 time=12:53:10 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"";
15+
final FortiGateSyslogEvent event = new FortiGateSyslogEvent(rawMessage);
16+
17+
assertThat(event).isNotNull();
18+
assertThat(event.getFacility()).isEqualTo(5);
19+
assertThat(event.getLevel()).isEqualTo(5);
20+
assertThat(event.getHost()).isEqualTo("DEVICENAME");
21+
assertThat(ZonedDateTime.ofInstant(event.getDate().toInstant(), ZoneOffset.UTC))
22+
.isEqualTo(ZonedDateTime.of(2017, 3, 6, 12, 53, 10, 0, ZoneOffset.UTC));
23+
assertThat(event.getRaw()).isEqualTo(rawMessage.getBytes(StandardCharsets.UTF_8));
24+
assertThat(event.getMessage()).isEqualTo("date=2017-03-06 time=12:53:10 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"");
25+
assertThat(event.getFields())
26+
.containsEntry("date", "2017-03-06")
27+
.containsEntry("time", "12:53:10")
28+
.containsEntry("devname", "DEVICENAME")
29+
.containsEntry("devid", "DEVICEID")
30+
.containsEntry("hostname", "HOSTNAME")
31+
.containsEntry("custom", "white space");
32+
}
33+
34+
}

0 commit comments

Comments
 (0)