Package org.jwall.web.audit

Examples of org.jwall.web.audit.ModSecurityEventMessage


      String line = r.readLine();

      while (line != null) {
        if (line.startsWith("Message: ")) {
          log.debug("Parsing: {}", line);
          ModSecurityEventMessage m = new ModSecurityEventMessage();

          String theMesg = line.substring("Message: ".length());

          //
          // TODO: The following should be enhanced to get the
          // extractions done in a 1-pass manner
          //

          String file = extract("file", theMesg);
          m.setFile(file);
          if (file != null) {
            theMesg = remove("file", theMesg);
          }

          String lineNr = extract("line", theMesg);
          if (lineNr != null) {
            try {
              m.setLine(Integer.parseInt(lineNr));
            } catch (Exception e) {
              log.error("Not a line-number: {}", lineNr);
              e.printStackTrace();
            }
            theMesg = remove("line", theMesg);
          }

          String id = extract("id", theMesg);
          if (id != null) {
            m.setRuleId(id);
            theMesg = remove("id", theMesg);
          }

          String data = extract("data", theMesg);
          if (data != null) {
            m.setRuleData(data);
            theMesg = remove("data", theMesg);
          }

          String severity = extract("severity", theMesg);
          if (severity != null) {
            m.setSeverity(ModSecurity.getSeverity(severity));
            theMesg = remove("severity", theMesg);
          }

          String ruleMsg = extract("msg", theMesg);
          if (ruleMsg != null) {
            theMesg = remove("msg", theMesg);
            m.setRuleMsg(ruleMsg);
          }

          String tag = extract("tag", theMesg);
          while (tag != null) {
            theMesg = remove("tag", theMesg);
            m.setTag(tag);
            tag = extract("tag", theMesg);
          }

          m.setText(theMesg.trim());

          msgs.add(m);
        } else
          log.debug("Skipping: {}", line);
        line = r.readLine();
View Full Code Here


  }

  public static AuditEventMessage parseMessage(String line) {
    if (line.startsWith("Message: ")) {

      ModSecurityEventMessage m = new ModSecurityEventMessage();

      String theMesg = line.substring("Message: ".length());

      //
      // TODO: The following should be enhanced to get the extractions
      // done in a 1-pass manner
      //
      String file = extract("file", theMesg);
      m.setFile(file);
      if (file != null) {
        theMesg = remove("file", theMesg);
      }

      String lineNr = extract("line", theMesg);
      if (lineNr != null) {
        try {
          m.setLine(Integer.parseInt(lineNr));
        } catch (Exception e) {
          log.error("Not a line-number: {}", lineNr);
          e.printStackTrace();
        }
        theMesg = remove("line", theMesg);
      }

      String id = extract("id", theMesg);
      if (id != null) {
        m.setRuleId(id);
        theMesg = remove("id", theMesg);
      }

      String data = extract("data", theMesg);
      if (data != null) {
        m.setRuleData(data);
        theMesg = remove("data", theMesg);
      }

      String severity = extract("severity", theMesg);
      if (severity != null) {
        m.setSeverity(ModSecurity.getSeverity(severity));
        theMesg = remove("severity", theMesg);
      }

      String ruleMsg = extract("msg", theMesg);
      if (ruleMsg != null) {
        theMesg = remove("msg", theMesg);
        m.setRuleMsg(ruleMsg);
      }

      String tag = extract("tag", theMesg);
      while (tag != null) {
        theMesg = remove("tag", theMesg);
        m.setTag(tag);
        tag = extract("tag", theMesg);
      }

      m.setText(theMesg.trim());
      return m;
    } else
      return null;
  }
View Full Code Here

TOP

Related Classes of org.jwall.web.audit.ModSecurityEventMessage

Copyright © 2018 www.massapicom. All rights reserved.
All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.