*Oct 18 09:46:09: %NFPP_IP_GUARD-4-DOS_DETECTED: Host已经保持在数据库里面,结果运行一个查询页面后,显示的结果是只有was detected.(2010-10-18 9:46:9)
*Oct 18 09:46:09: %NFPP_IP_GUARD-4-DOS_DETECTED: Host was detected.(2010-10-18 9:46:9)
//------------------------------------------------------------------------
// Output the table with the results
// Use an alternating background and color code the priority column
//------------------------------------------------------------------------
if(CEMDB == "ON") {
require_once 'includes/CEMDB.class.php';
$cemdb = new CEMDB($dbLink);
}
$color = "lighter";
$today = date('Y-m-d');
for($i=0; $i < count($result_array); $i++) {
$row = $result_array[$i];
if($color == "darker") {
$color = "lighter";
echo "";
}
else {
$color = "darker";
echo ""; \n";
}
// Checkboxes for export to Excel
echo "";
// SEQ Field
if(defined('SEQ') && SEQ == TRUE) {
if (!preg_match("/\d+/", $row['seq'])) {
list($id) = split(':', $row['msg']);
if(is_numeric($id)) {
echo "".$id." ";
} else {
echo "N/A ";
}
} else {
echo "".$row['seq']." ";
}
}
echo ""; ";
echo $row['host']."
echo "switch ($row['priority']) { \n";
case 'debug':
echo 'sev0';
break;
case 'info':
echo 'sev1';
break;
case 'notice':
echo 'sev2';
break;
case 'warning':
echo 'sev3';
break;
case 'err':
echo 'sev4';
break;
case 'crit':
echo 'sev5';
break;
case 'alert':
echo 'sev6';
break;
case 'emerg':
echo 'sev7';
break;
}
echo "\">";
echo $row['facility']."
// echo "".$row['fo']." ";
if(defined('SQZ_ENABLED') && SQZ_ENABLED == TRUE) {
$pieces = explode(' ', $row['fo']);
echo ''; \n";
if ($pieces[0]!=$today) {
echo $pieces[0]." ";
}
echo $pieces[1];
echo "
// echo "".$row['fo']." ";
$pieces = explode(' ', $row['lo']);
echo ''; \n";
if ($pieces[0]!=$today) {
echo $pieces[0]." ";
}
echo $pieces[1];
echo "
// Counter row follows
echo "".$row['counter']." ";
}
/* END: Switched by BPK to allow filtering based on facility */
/* BEGIN: Added by BPK to hide the date if it's the same as today
echo "".$row['fo']." ";
*/
$pieces = explode(' ', $row['fo']);
echo ''; \n";
if ($pieces[0]!=$today) {
echo $pieces[0]." ";
}
echo $pieces[1];
echo "
echo ''; \n";
$program = htmlspecialchars($row['program']);
if (!empty($program)) {
$pattern = '/^'.addcslashes($program, '.()[]/\\').'/';
$replacement = ''.$program.'';
$program = preg_replace($pattern, $replacement, $program);
}
if($row['program'] == $id) {
$program = "Syslog";
}
echo $program;
echo "
if (CISCO_TAG_PARSE ) {
$row['msg'] = preg_replace('/\s:/', ':', $row['msg']);
$row['msg'] = preg_replace('/.*(%.*?:.*)/', '$1', $row['msg']);
}
// CDUKES: 2009-06-18 - Added below to allow filtering on individual message pieces
if(defined('MSG_EXPLODE') && MSG_EXPLODE == TRUE) {
$explode_url = "";
$pieces = explode(" ", $row['msg']);
foreach($pieces as $value) {
// had to add rtrim below for cisco messages - when searching, the : was not returning any results
$explode_url .= " ".$value." ";
}
}
// Original message:
// 3852752: DRP/0/0/CPU0:Feb 4 20:12:36.098 EST5: SSHD_[65697]: %SECURITY-SSHD-3-ERR_GENERAL: Failed to get DSA public key
// New message using regex above: .*(%.*?:.*):
// SSHD_[65697]: %SECURITY-SSHD-3-ERR_GENERAL: Failed to get DSA public key
if(CEMDB == "ON") {
$data = $cemdb->lookup($row['msg']);
}
// BPK - this is where the revised version begins
// CDUKES - BETA - FIX THIS
$printed = false;
if (CEMDB == "ON") {
$data = $cemdb->lookup($row['msg']);
if($data !== false) {
$info = "Name:" . $data[0];
$info .= "
Message: " . $data[1];
$info .= "
Explanation: " . $data[2];
$info .= "
Action: " . $data[3];
$info .= "
Record last updated on: " . $data[4];
$info = str_replace("\n", "", $info);
$info = htmlentities($info);
// CDUKES: 2009-06-18 - Changed below for MSG_EXPLODE mod
?>
\n";
if(defined('MSG_EXPLODE') && MSG_EXPLODE == TRUE) {
?>
echo "[CEMDB] ";
echo "$explode_url
} else {
?>
echo $row['$msg'];
?>
}
$printed = true;
}
}
// if CEMDB off or row wasn't found, print it
// this will prevent unnecessary popups and allow filtering via a link
if (!$printed) {
$msg = htmlspecialchars($row['msg']);
echo ""; \n";
if ($row['count'] > 1) echo ''.$row['count'].' * ';
// CDUKES: 2009-06-18 - Changed below for MSG_EXPLODE mod
// echo "$msg
if(defined('MSG_EXPLODE') && MSG_EXPLODE == TRUE) {
echo "$explode_url\n";
} else {
#$msg = preg_replace('/[\x00-\x1F\x80-\xFF]/', '', $msg); # <-moved filter to db_insert.pl
echo "$msg\n";
}
}
echo "
}
?>
echo "\n";
echo "\n";
if (CISCO_TAG_PARSE ) {
$row['msg'] = preg_replace('/\s:/', ':', $row['msg']);
$row['msg'] = preg_replace('/.*(%.*?:.*)/', '$1', $row['msg']);
}
// CDUKES: 2009-06-18 - Added below to allow filtering on individual message pieces
if(defined('MSG_EXPLODE') && MSG_EXPLODE == TRUE) {
$explode_url = "";
$pieces = explode(" ", $row['msg']);
foreach($pieces as $value) {
// had to add rtrim below for cisco messages - when searching, the : was not returning any results
$explode_url .= " ".$value." ";
}
}
if (CISCO_TAG_PARSE ) {
$row['msg'] = preg_replace('/\s:/', ':', $row['msg']);
$row['msg'] = preg_replace('/.*(%.*?:.*)/', '$1', $row['msg']);
}
if (CISCO_TAG_PARSE )
{
$row['msg'] = preg_replace('/', ' ', $row['msg']);
$row['msg'] = preg_replace('/>/', ' ', $row['msg']);
$row['msg'] = preg_replace('/\s:/', ':', $row['msg']);
$row['msg'] = preg_replace('/.*(%.*?:.*)/', '$1', $row['msg']);
}