def ParseLine(self, parser_context): """Return an event object extracted from the current line. Args: parser_context: A parser context object (instance of ParserContext). Returns: An event object (instance of TextEvent). """ if not self.attributes['time']: raise errors.TimestampNotCorrectlyFormed( u'Unable to parse timestamp, time not set.') if not self.attributes['iyear']: raise errors.TimestampNotCorrectlyFormed( u'Unable to parse timestamp, year not set.') times = self.attributes['time'].split(':') if self.local_zone: timezone = parser_context.timezone else: timezone = pytz.UTC if len(times) < 3: raise errors.TimestampNotCorrectlyFormed( (u'Unable to parse timestamp, not of the format HH:MM:SS ' u'[{0:s}]').format(self.PrintLine())) try: secs = times[2].split('.') if len(secs) == 2: sec, us = secs else: sec = times[2] us = 0 timestamp = timelib.Timestamp.FromTimeParts( int(self.attributes['iyear']), self.attributes['imonth'], self.attributes['iday'], int(times[0]), int(times[1]), int(sec), microseconds=int(us), timezone=timezone) except ValueError as exception: raise errors.TimestampNotCorrectlyFormed( u'Unable to parse: {0:s} with error: {1:s}'.format( self.PrintLine(), exception)) return self.CreateEvent(timestamp, getattr(self, 'entry_offset', 0), self.attributes)
def ParseLine(self, parser_mediator): """Parse a single line from the SELinux audit file. This method extends the one from TextParser slightly, creating a SELinux event with the timestamp (UTC) taken from log entries. Args: parser_mediator: A parser mediator object (instance of ParserMediator). """ if not self.timestamp: raise errors.TimestampNotCorrectlyFormed( u'Unable to parse entry, timestamp not defined.') offset = getattr(self, u'entry_offset', 0) event_object = SELinuxLineEvent(self.timestamp, offset, self.attributes) parser_mediator.ProduceEvent(event_object) self.timestamp = 0
def ParseLine(self, parser_context): """Parse a single line from the SELinux audit file. This method extends the one from TextParser slightly, creating a SELinux event with the timestamp (UTC) taken from log entries. Args: parser_context: A parser context object (instance of ParserContext). Returns: An event object (instance of EventObject) that is constructed from the selinux entry. """ if not self.timestamp: raise errors.TimestampNotCorrectlyFormed( u'Unable to parse entry, timestamp not defined.') offset = getattr(self, 'entry_offset', 0) event_object = SELinuxLineEvent(self.timestamp, offset, self.attributes) self.timestamp = 0 return event_object