def StandardErrorObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", "-") == "-":
logSystem = "{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_source") is not None:
logSystem += " " + qual(event["log_source"].__class__)
if format == "colour":
# Errors are always red, no matter the system they came from.
eventString = COLOUR_FORMAT.format(
Fore.RED, formatTime(event["log_time"]), logSystem, Fore.RESET,
formatEvent(event))
elif format == "nocolour":
eventString = NOCOLOUR_FORMAT.format(
formatTime(event["log_time"]), logSystem, formatEvent(event))
elif format == "syslogd":
eventString = SYSLOGD_FORMAT.format(logSystem, formatEvent(event))
print(eventString, file=_stderr)
def StandardErrorObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace", event.get("log_namespace", ''))
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = ""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
if format == "colour":
# Errors are always red, no matter the system they came from.
eventString = COLOUR_FORMAT.format(
Fore.RED, formatTime(event["log_time"]), logSystem, Fore.RESET,
eventText)
elif format == "nocolour":
eventString = NOCOLOUR_FORMAT.format(
formatTime(event["log_time"]), logSystem, eventText)
elif format == "syslogd":
eventString = SYSLOGD_FORMAT.format(logSystem, eventText)
print(eventString, file=_file)
def __call__(self, event):
# it seems if a twisted.logger.Logger() has .failure() called
# on it, the log_format will be None for the traceback after
# "Unhandled error in Deferred" -- perhaps this is a Twisted
# bug?
if event['log_format'] is None:
msg = u'{0} {1}{2}'.format(
formatTime(event["log_time"]),
failure_format_traceback(event['log_failure']),
os.linesep,
)
if self._encode:
msg = msg.encode('utf8')
self._file.write(msg)
else:
# although Logger will already have filtered out unwanted
# levels, bare Logger instances from Twisted code won't have.
if 'log_level' in event and self._acceptable_level(event['log_level']):
msg = u'{0} {1}{2}'.format(
formatTime(event["log_time"]),
formatEvent(event),
os.linesep,
)
if self._encode:
msg = msg.encode('utf8')
self._file.write(msg)
def __call__(self, event):
# it seems if a twisted.logger.Logger() has .failure() called
# on it, the log_format will be None for the traceback after
# "Unhandled error in Deferred" -- perhaps this is a Twisted
# bug?
if event['log_format'] is None:
msg = u'{0} {1}{2}'.format(
formatTime(event["log_time"]),
failure_format_traceback(event['log_failure']),
os.linesep,
)
if self._encode:
msg = msg.encode('utf8')
self._file.write(msg)
else:
# although Logger will already have filtered out unwanted
# levels, bare Logger instances from Twisted code won't have.
if 'log_level' in event and self._acceptable_level(
event['log_level']):
msg = u'{0} {1}{2}'.format(
formatTime(event["log_time"]),
formatEvent(event),
os.linesep,
)
if self._encode:
msg = msg.encode('utf8')
self._file.write(msg)
def StandardOutObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", "-") == "-":
logSystem = "{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace", event.get("log_namespace", ''))
if format == "colour":
# Choose a colour depending on where the log came from.
if "Controller" in logSystem:
fore = Fore.BLUE
elif "Router" in logSystem:
fore = Fore.YELLOW
elif "Container" in logSystem:
fore = Fore.GREEN
else:
fore = Fore.WHITE
eventString = COLOUR_FORMAT.format(
fore, formatTime(event["log_time"]), logSystem, Fore.RESET,
formatEvent(event))
elif format == "nocolour":
eventString = NOCOLOUR_FORMAT.format(
formatTime(event["log_time"]), logSystem, formatEvent(event))
elif format == "syslogd":
eventString = SYSLOGD_FORMAT.format(logSystem, formatEvent(event))
print(eventString, file=_file)
def StandardOutObserver(event):
if event["log_level"] not in levels:
return
if event["log_level"] == LogLevel.debug:
if event.get("txaio_trace", False) and not trace:
return
if event.get("log_system", "-") == "-":
logSystem = "{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace",
event.get("log_namespace", ''))
if event.get("log_category"):
format_string = _categories.get(event['log_category'])
if format_string:
event = event.copy()
event["log_format"] = format_string
if format == "standard":
FORMAT_STRING = STANDARD_FORMAT
elif format == "syslogd":
FORMAT_STRING = SYSLOGD_FORMAT
elif format == "none":
FORMAT_STRING = NONE_FORMAT
else:
assert False
if color:
# Choose a color depending on where the log came from.
if "Controller" in logSystem:
fore = Fore.BLUE
elif "Router" in logSystem:
fore = Fore.YELLOW
elif "Container" in logSystem:
fore = Fore.GREEN
else:
fore = Fore.WHITE
eventString = FORMAT_STRING.format(startcolor=fore,
time=formatTime(
event["log_time"]),
system=logSystem,
endcolor=Fore.RESET,
text=formatEvent(event))
else:
eventString = strip_ansi(
FORMAT_STRING.format(startcolor=u'',
time=formatTime(event["log_time"]),
system=logSystem,
endcolor=u'',
text=formatEvent(event)))
print(eventString, file=_file)
def StandardErrorObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace",
event.get("log_namespace", ''))
if event.get("log_category"):
format_string = _categories.get(event['log_category'])
if format_string:
event = event.copy()
event["log_format"] = format_string
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = u""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
if format == "standard":
FORMAT_STRING = STANDARD_FORMAT
elif format == "syslogd":
FORMAT_STRING = SYSLOGD_FORMAT
elif format == "none":
FORMAT_STRING = NONE_FORMAT
else:
assert False
if color:
# Errors are always red.
fore = Fore.RED
eventString = FORMAT_STRING.format(startcolor=fore,
time=formatTime(
event["log_time"]),
system=logSystem,
endcolor=Fore.RESET,
text=eventText)
else:
eventString = strip_ansi(
FORMAT_STRING.format(startcolor=u'',
time=formatTime(event["log_time"]),
system=logSystem,
endcolor=u'',
text=eventText))
print(eventString, file=_file)
def StandardOutObserver(event):
if event["log_level"] not in levels:
return
if event["log_level"] == LogLevel.debug:
if event.get("txaio_trace", False) and not trace:
return
if event.get("log_system", "-") == "-":
logSystem = "{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace", event.get("log_namespace", ''))
if event.get("log_category"):
format_string = _categories.get(event['log_category'])
if format_string:
event = event.copy()
event["log_format"] = format_string
if format == "standard":
FORMAT_STRING = STANDARD_FORMAT
elif format == "syslogd":
FORMAT_STRING = SYSLOGD_FORMAT
elif format == "none":
FORMAT_STRING = NONE_FORMAT
else:
assert False
if colour:
# Choose a colour depending on where the log came from.
if "Controller" in logSystem:
fore = Fore.BLUE
elif "Router" in logSystem:
fore = Fore.YELLOW
elif "Container" in logSystem:
fore = Fore.GREEN
else:
fore = Fore.WHITE
eventString = FORMAT_STRING.format(
startcolour=fore, time=formatTime(event["log_time"]),
system=logSystem, endcolour=Fore.RESET,
text=formatEvent(event))
else:
eventString = strip_ansi(FORMAT_STRING.format(
startcolour=u'', time=formatTime(event["log_time"]),
system=logSystem, endcolour=u'',
text=formatEvent(event)))
print(eventString, file=_file)
def StandardErrorObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace", event.get("log_namespace", ''))
if event.get("log_category"):
format_string = _categories.get(event['log_category'])
if format_string:
event = event.copy()
event["log_format"] = format_string
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = u""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
if format == "standard":
FORMAT_STRING = STANDARD_FORMAT
elif format == "syslogd":
FORMAT_STRING = SYSLOGD_FORMAT
elif format == "none":
FORMAT_STRING = NONE_FORMAT
else:
assert False
if colour:
# Errors are always red.
fore = Fore.RED
eventString = FORMAT_STRING.format(
startcolour=fore, time=formatTime(event["log_time"]),
system=logSystem, endcolour=Fore.RESET,
text=formatEvent(event))
else:
eventString = strip_ansi(FORMAT_STRING.format(
startcolour=u'', time=formatTime(event["log_time"]),
system=logSystem, endcolour=u'',
text=formatEvent(event)))
print(eventString, file=_file)
def formatLogEvent(event, formatTime=formatTime):
eventText = formatEvent(event)
if not eventText:
return None
eventText = eventText.replace(u"\n", u"\n\t")
timeStamp = formatTime(event.get("log_time", None))
system = event.get("log_system", None)
if system is None:
level = event.get("log_level", None)
if level is None:
levelName = u"-"
else:
levelName = level.name
system = u"{namespace}".format(
namespace=event.get("log_namespace", u"-"),
)
else:
try:
system = unicode(system)
except Exception:
system = u"UNFORMATTABLE"
return u"{timeStamp} [{system}] {level}: {event}\n".format(
timeStamp=timeStamp,
system=system.ljust(35),
level=levelName.upper().ljust(8),
event=eventText,
)
def _render(event):
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace",
event.get("log_namespace", ''))
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = u""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
eventString = strip_ansi(
STANDARD_FORMAT.format(startcolor=u'',
time=formatTime(event["log_time"]),
system=logSystem,
endcolor=u'',
text=eventText)) + os.linesep
return eventString
def __call__(self, event):
"""
Write event to file.
@param event: An event.
@type event: L{dict}
"""
text = formatEventAsClassicLogText(
event, formatTime=lambda e: formatTime(e, self.timeFormat))
if text is None:
text = u""
if "log_failure" in event:
try:
traceback = event["log_failure"].getTraceback()
except Exception:
traceback = u"(UNABLE TO OBTAIN TRACEBACK FROM EVENT)\n"
text = u"\n".join((text, traceback))
if self._encoding is not None:
text = text.encode(self._encoding)
if text:
if event['log_level'] > LogLevel.warn:
self._err.write(text)
self._err.flush()
else:
self._out.write(text)
self._out.flush()
def _render(event):
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace", event.get("log_namespace", ''))
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = u""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
eventString = strip_ansi(STANDARD_FORMAT.format(
startcolour=u'', time=formatTime(event["log_time"]),
system=logSystem, endcolour=u'',
text=eventText)) + os.linesep
return eventString
def formatLogEvent(event, formatTime=formatTime):
eventText = formatEvent(event)
if not eventText:
return None
eventText = eventText.replace(u"\n", u"\n\t")
timeStamp = formatTime(event.get("log_time", None))
system = event.get("log_system", None)
level = event.get("log_level", None)
if level is None:
levelName = u"-"
else:
levelName = level.name
if system is None:
system = u"{namespace}".format(namespace=event.get(
"log_namespace", u"-"), )
else:
try:
system = str(system)
except Exception:
system = u"UNFORMATTABLE"
return u"{timeStamp} [{system}] {level}: {event}\n".format(
timeStamp=timeStamp,
system=system.ljust(35),
level=levelName.upper().ljust(8),
event=eventText,
)
def formatEvent(event):
log_level = event.get('log_level')
if log_level is not None and log_level < config_level:
# 比配置级别低的日志直接丢弃
return None
return formatEventAsClassicLogText(
event, formatTime=lambda e: formatTime(e, timeFormat))
def StandardOutObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", "-") == "-":
logSystem = "{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace",
event.get("log_namespace", ''))
if format == "colour":
# Choose a colour depending on where the log came from.
if "Controller" in logSystem:
fore = Fore.BLUE
elif "Router" in logSystem:
fore = Fore.YELLOW
elif "Container" in logSystem:
fore = Fore.GREEN
else:
fore = Fore.WHITE
eventString = COLOUR_FORMAT.format(fore,
formatTime(event["log_time"]),
logSystem, Fore.RESET,
formatEvent(event))
elif format == "nocolour":
eventString = NOCOLOUR_FORMAT.format(formatTime(event["log_time"]),
logSystem, formatEvent(event))
elif format == "syslogd":
eventString = SYSLOGD_FORMAT.format(logSystem, formatEvent(event))
elif format == "none":
eventString = formatEvent(event)
else:
assert False
if not format == "colour":
eventString = strip_ansi(eventString)
print(eventString, file=_file)
def StandardErrorObserver(event):
if event["log_level"] not in levels:
return
if event.get("log_system", u"-") == u"-":
logSystem = u"{:<10} {:>6}".format("Controller", os.getpid())
else:
logSystem = event["log_system"]
if show_source and event.get("log_namespace") is not None:
logSystem += " " + event.get("cb_namespace",
event.get("log_namespace", ''))
if event.get("log_format", None) is not None:
eventText = formatEvent(event)
else:
eventText = ""
if "log_failure" in event:
# This is a traceback. Print it.
eventText = eventText + event["log_failure"].getTraceback()
if format == "colour":
# Errors are always red, no matter the system they came from.
eventString = COLOUR_FORMAT.format(Fore.RED,
formatTime(event["log_time"]),
logSystem, Fore.RESET,
eventText)
elif format == "nocolour":
eventString = NOCOLOUR_FORMAT.format(formatTime(event["log_time"]),
logSystem, eventText)
elif format == "syslogd":
eventString = SYSLOGD_FORMAT.format(logSystem, eventText)
elif format == "none":
eventString = formatEvent(event)
else:
assert False
if not format == "colour":
eventString = strip_ansi(eventString)
print(eventString, file=_file)
def _formatModernEvent(event):
"""Format a "modern" event according to MAAS's conventions."""
text = twistedModern.formatEvent(event)
time = event["log_time"] if "log_time" in event else None
level = event["log_level"] if "log_level" in event else None
system = event["log_system"] if "log_system" in event else None
if system is None and "log_namespace" in event:
system = _getSystemName(event["log_namespace"])
return _lineFormat % {
"asctime": twistedModern.formatTime(time, _timeFormat),
"levelname": "-" if level is None else level.name,
"message": "-" if text is None else text.replace("\n", "\n\t"),
"name": "-" if system is None else system,
}
def test_output_standard(self):
"""
The output format is the time, the system in square brackets, and the
message.
"""
stream = NativeStringIO()
observer = make_stderr_observer(_file=stream, format="standard")
event = {'log_level': LogLevel.error,
'log_namespace': 'crossbar.test.test_logger.StdoutObserverTests',
'log_source': None, 'log_format': 'Hi there!',
'log_system': 'foo', 'log_time': 1434099813.77449}
observer(event)
result = stream.getvalue()
self.assertEqual(result[:-1],
formatTime(event["log_time"]) + " [foo] Hi there!")
def test_output_standard(self):
"""
The output format is the time, the system in square brackets, and the
message.
"""
stream = NativeStringIO()
observer = make_stderr_observer(_file=stream, format="standard")
event = {'log_level': LogLevel.error,
'log_namespace': 'crossbar.test.test_logger.StdoutObserverTests',
'log_source': None, 'log_format': 'Hi there!',
'log_system': 'foo', 'log_time': 1434099813.77449}
observer(event)
result = stream.getvalue()
self.assertEqual(result[:-1],
formatTime(event["log_time"]) + " [foo] Hi there!")
def test_output_nocolour(self):
"""
The output format is the time, the system in square brackets, and the
message.
"""
stream = NativeStringIO()
observer = _logging.make_stdout_observer(_file=stream, format="nocolour")
event = {
"log_level": LogLevel.info,
"log_namespace": "crossbar.test.test_logger.StdoutObserverTests",
"log_source": None,
"log_format": "Hi there!",
"log_system": "foo",
"log_time": 1434099813.77449,
}
observer(event)
result = stream.getvalue()
self.assertEqual(result[:-1], formatTime(event["log_time"]) + " [foo] Hi there!")
def test_format_failure(self):
try:
1 / 0
except ZeroDivisionError:
failure = Failure()
log_system = factory.make_name("system")
log_time = pick_log_time()
self.assertThat(
_formatModernEvent({
"log_time": log_time,
"log_system": log_system,
"log_level": self.log_level,
"log_failure": failure,
}),
Equals(
"%s %s: [%s] \n\t%s\n" %
(logger.formatTime(log_time, DEFAULT_LOG_FORMAT_DATE),
log_system, self.log_level.name,
failure.getTraceback().replace("\n", "\n\t")), ),
)
def test_format_basics(self):
thing1 = factory.make_name("thing")
thing2 = factory.make_name("thing")
log_system = factory.make_name("system")
log_format = ">{thing1}< >{thing2}<"
log_time = pick_log_time()
self.assertThat(
_formatModernEvent({
"log_time": log_time,
"log_format": log_format,
"log_system": log_system,
"log_level": self.log_level,
"thing1": thing1,
"thing2": thing2,
}),
Equals(
"%s %s: [%s] >%s< >%s<\n" %
(logger.formatTime(log_time, DEFAULT_LOG_FORMAT_DATE),
log_system, self.log_level.name, thing1, thing2), ),
)
def _formatModernEvent(event):
"""Format a "modern" event according to MAAS's conventions."""
text = twistedModern.formatEvent(event)
if "log_failure" in event:
try:
traceback = event["log_failure"].getTraceback()
except Exception:
traceback = u"(UNABLE TO OBTAIN TRACEBACK FROM EVENT)\n"
text = "\n".join((text, traceback))
time = event["log_time"] if "log_time" in event else None
level = event["log_level"] if "log_level" in event else None
system = event["log_system"] if "log_system" in event else None
if system is None and "log_namespace" in event:
system = _getSystemName(event["log_namespace"])
return _lineFormat % {
"asctime": twistedModern.formatTime(time, _timeFormat),
"levelname": "-" if level is None else level.name,
"message": "-" if text is None else text.replace("\n", "\n\t"),
"name": "-" if system is None else system,
}
def formatLuminaLogText(event, formatTime=formatTime):
""" Format an event as a line of human-readable text. """
eventText = formatEvent(event)
if not eventText:
return None
eventText = eventText.replace(u"\n", u"\n\t")
timeStamp = formatTime(event.get("log_time", None))
system = event.get("log_system", None)
level = event.get("log_level", None)
if level is None:
levelName = u"-"
else:
levelName = level.name
return u"{timeStamp} {level:<8} [{system}] {event}\n".format(
timeStamp=timeStamp,
level=levelName,
system=system,
event=eventText,
)
)
bcolor = {'debug':'\033[94m',
'info':'\033[92m',
'warn':'\033[93m',
'error':'\033[91m',
'default':'\033[33m',
}
@provider(ILogObserver)
def simpleObserver(event):
# event['log_system'] = "asdf"
print event
print(formatEvent(event))
logFormat = lambda event: u"{0} [{1}]: {2}".format(formatTime(event["log_time"]), event["log_level"].name.upper(),
formatEvent(event))
@provider(ILogObserver)
def consoleLogObserver(event):
print u"[{0}{1}\033[39m-{2}]: {3}".format(bcolor[event["log_level"].name.lower()], event["log_level"].name.upper(), event["log_namespace"], formatEvent(event))
def get_logger(logname='yombolog', **kwargs):
"""
Returns a logger object that allows logging of error messages.
**Usage**:
.. code-block:: python
def emit(self, event):
"""
This is the main emit() hook that gets called by the the Twisted logging
To make this work with Cowrie, the event dictionary needs the following keys:
- 'eventid'
- 'sessionno' or 'session'
- 'message' or 'format'
"""
# Ignore stdout and stderr in output plugins
if 'printed' in event:
return
# Ignore anything without eventid
if 'eventid' not in event:
return
# Ignore anything without session information
if 'sessionno' not in event and 'session' not in event and 'system' not in event:
return
# Ignore anything without message
if 'message' not in event and 'format' not in event:
return
ev = convert(event)
ev['sensor'] = self.sensor
if 'isError' in ev:
del ev['isError']
# Add ISO timestamp and sensor data
if 'time' not in ev:
ev['time'] = time.time()
ev['timestamp'] = formatTime(ev['time'], timeFormat=self.timeFormat)
if 'format' in ev and ('message' not in ev or ev['message'] == ()):
try:
ev['message'] = ev['format'] % ev
del ev['format']
except Exception:
pass
# Explicit sessionno (from logDispatch) overrides from 'system'
if 'sessionno' in ev:
sessionno = ev['sessionno']
del ev['sessionno']
# Maybe it's passed explicitly
elif 'session' in ev:
# reverse engineer sessionno
try:
sessionno = next(key for key, value in self.sessions.items()
if value == ev['session'])
except StopIteration:
return
# Extract session id from the twisted log prefix
elif 'system' in ev:
sessionno = 0
telnetmatch = self.telnetRegex.match(ev['system'])
if telnetmatch:
sessionno = 'T{}'.format(telnetmatch.groups()[0])
else:
sshmatch = self.sshRegex.match(ev['system'])
if sshmatch:
sessionno = 'S{}'.format(sshmatch.groups()[0])
if sessionno == 0:
return
if sessionno in self.ips:
ev['src_ip'] = self.ips[sessionno]
# Connection event is special. adds to session list
if ev['eventid'] == 'cowrie.session.connect':
self.sessions[sessionno] = ev['session']
self.ips[sessionno] = ev['src_ip']
else:
ev['session'] = self.sessions[sessionno]
self.write(ev)
# Disconnect is special, remove cached data
if ev['eventid'] == 'cowrie.session.closed':
del self.sessions[sessionno]
del self.ips[sessionno]
def emit(self, event: dict) -> None:
"""
This is the main emit() hook that gets called by the the Twisted logging
To make this work with Cowrie, the event dictionary needs the following keys:
- 'eventid'
- 'sessionno' or 'session'
- 'message' or 'format'
"""
sessionno: str
ev: dict
# Ignore stdout and stderr in output plugins
if "printed" in event:
return
# Ignore anything without eventid
if "eventid" not in event:
return
# Ignore anything without session information
if ("sessionno" not in event and "session" not in event
and "system" not in event):
return
# Ignore anything without message
if "message" not in event and "format" not in event:
return
ev: Dict[str, any] = convert(event) # type: ignore
ev["sensor"] = self.sensor
if "isError" in ev:
del ev["isError"]
# Add ISO timestamp and sensor data
if "time" not in ev:
ev["time"] = time.time()
ev["timestamp"] = formatTime(ev["time"], timeFormat=self.timeFormat)
if "format" in ev and ("message" not in ev or ev["message"] == ()):
try:
ev["message"] = ev["format"] % ev
del ev["format"]
except Exception:
pass
# Explicit sessionno (from logDispatch) overrides from 'system'
if "sessionno" in ev:
sessionno = ev["sessionno"]
del ev["sessionno"]
# Maybe it's passed explicitly
elif "session" in ev:
# reverse engineer sessionno
try:
sessionno = next(key for key, value in self.sessions.items()
if value == ev["session"])
except StopIteration:
return
# Extract session id from the twisted log prefix
elif "system" in ev:
sessionno = "0"
telnetmatch = self.telnetRegex.match(ev["system"])
if telnetmatch:
sessionno = f"T{telnetmatch.groups()[0]}"
else:
sshmatch = self.sshRegex.match(ev["system"])
if sshmatch:
sessionno = f"S{sshmatch.groups()[0]}"
if sessionno == "0":
return
if sessionno in self.ips:
ev["src_ip"] = self.ips[sessionno]
# Connection event is special. adds to session list
if ev["eventid"] == "cowrie.session.connect":
self.sessions[sessionno] = ev["session"]
self.ips[sessionno] = ev["src_ip"]
else:
ev["session"] = self.sessions[sessionno]
self.write(ev)
# Disconnect is special, remove cached data
if ev["eventid"] == "cowrie.session.closed":
del self.sessions[sessionno]
del self.ips[sessionno]
def onlyUpgradeEvents(eventDict):
text = formatEvent(eventDict)
output.write(
formatTime(eventDict.get("log_time", time.time())) + " " + text +
"\n")
output.flush()
def consoleLogObserver(event):
print u"{0} [{1}]: {2}".format(formatTime(event["log_time"]), event["log_level"].name.upper(), formatEvent(event))
def consoleLogObserver(event):
print u"{0} [{1}]: {2}".format(formatTime(event["log_time"]),
event["log_level"].name.upper(),
formatEvent(event))
from twisted.logger import formatEvent, formatTime, ILogObserver
from zope.interface import provider
logFormat = lambda event: u"{0} [{1}]: {2}".format(
formatTime(event["log_time"]), event["log_level"].name.upper(),
formatEvent(event))
@provider(ILogObserver)
def consoleLogObserver(event):
print u"{0} [{1}]: {2}".format(formatTime(event["log_time"]),
event["log_level"].name.upper(),
formatEvent(event))
def formatEvent(event):
return formatLogEvent(
event, formatTime=lambda e: formatTime(e, timeFormat)
)
def formatEvent(event):
return formatLogEvent(event,
formatTime=lambda e: formatTime(e, timeFormat))
def log_event_format(event):
return u"{0} [{1}]: {2}\n".format(formatTime(event["log_time"]),
event["log_level"].name.upper(),
formatEvent(event))
def emit(self, event):
"""
This is the main emit() hook that gets called by the the Twisted logging
To make this work with Cowrie, the event dictionary needs the following keys:
- 'eventid'
- 'sessionno' or 'session'
- 'message' or 'format'
"""
# Ignore stdout and stderr in output plugins
if 'printed' in event:
return
# Ignore anything without eventid
if 'eventid' not in event:
return
# Ignore anything without session information
if 'sessionno' not in event and 'session' not in event and 'system' not in event:
return
# Ignore anything without message
if 'message' not in event and 'format' not in event:
return
ev = convert(event)
ev['sensor'] = self.sensor
if 'isError' in ev:
del ev['isError']
# Add ISO timestamp and sensor data
if 'time' not in ev:
ev['time'] = time.time()
ev['timestamp'] = formatTime(ev['time'], timeFormat=self.timeFormat)
if 'format' in ev and ('message' not in ev or ev['message'] == ()):
try:
ev['message'] = ev['format'] % ev
del ev['format']
except Exception:
pass
# Explicit sessionno (from logDispatch) overrides from 'system'
if 'sessionno' in ev:
sessionno = ev['sessionno']
del ev['sessionno']
# Maybe it's passed explicitly
elif 'session' in ev:
# reverse engineer sessionno
try:
sessionno = next(key for key, value in self.sessions.items() if value == ev['session'])
except StopIteration:
return
# Extract session id from the twisted log prefix
elif 'system' in ev:
sessionno = 0
telnetmatch = self.telnetRegex.match(ev['system'])
if telnetmatch:
sessionno = 'T{}'.format(telnetmatch.groups()[0])
else:
sshmatch = self.sshRegex.match(ev['system'])
if sshmatch:
sessionno = 'S{}'.format(sshmatch.groups()[0])
if sessionno == 0:
return
if sessionno in self.ips:
ev['src_ip'] = self.ips[sessionno]
# Connection event is special. adds to session list
if ev['eventid'] == 'cowrie.session.connect':
self.sessions[sessionno] = ev['session']
self.ips[sessionno] = ev['src_ip']
else:
ev['session'] = self.sessions[sessionno]
self.write(ev)
# Disconnect is special, remove cached data
if ev['eventid'] == 'cowrie.session.closed':
del self.sessions[sessionno]
del self.ips[sessionno]