def testAuditLogsForTimespan(self):
two_weeks_ago = rdfvalue.RDFDatetime.Now() - rdfvalue.Duration("2w")
with test_lib.FakeTime(two_weeks_ago):
AddFakeAuditLog("Fake outdated audit log.", token=self.token)
AddFakeAuditLog("Fake audit description foo.", token=self.token)
AddFakeAuditLog("Fake audit description bar.", token=self.token)
audit_events = {
ev.description: ev for fd in audit.AuditLogsForTimespan(
rdfvalue.RDFDatetime.Now() - rdfvalue.Duration("1d"),
rdfvalue.RDFDatetime.Now(),
token=self.token) for ev in fd.GenerateItems()
}
self.assertIn("Fake audit description foo.", audit_events)
self.assertIn("Fake audit description bar.", audit_events)
self.assertNotIn("Fake outdated audit log.", audit_events)
def GetReportData(self, get_report_args, token):
"""Filter the last week of user actions."""
ret = rdf_report_plugins.ApiReportData(
representation_type=rdf_report_plugins.ApiReportData.
RepresentationType.STACK_CHART)
try:
user_activity = {}
week_duration = rdfvalue.Duration("7d")
offset = rdfvalue.Duration("%dw" % self.WEEKS)
now = rdfvalue.RDFDatetime.Now()
start_time = now - offset - aff4.AUDIT_ROLLOVER_TIME
try:
for fd in audit.AuditLogsForTimespan(start_time, now, token):
for event in fd.GenerateItems():
for week in xrange(self.__class__.WEEKS):
start = now - week * week_duration
if start < event.timestamp < (start +
week_duration):
weekly_activity = user_activity.setdefault(
event.user, [[x, 0] for x in xrange(
-self.__class__.WEEKS, 0, 1)])
weekly_activity[-week][1] += 1
except ValueError: # Couldn't find any logs..
pass
ret.stack_chart.data = sorted(
(rdf_report_plugins.ApiReportDataSeries2D(
label=user,
points=(rdf_report_plugins.ApiReportDataPoint2D(x=x, y=y)
for x, y in data))
for user, data in user_activity.iteritems()
if user not in aff4_users.GRRUser.SYSTEM_USERS),
key=lambda series: series.label)
except IOError:
pass
return ret
def GetAuditLogEntries(offset, now, token):
"""Return all audit log entries between now-offset and now.
Args:
offset: rdfvalue.Duration how far back to look in time
now: rdfvalue.RDFDatetime for current time
token: GRR access token
Raises:
ValueError: No logs were found.
Yields:
AuditEvents created during the time range
"""
start_time = now - offset - aff4.AUDIT_ROLLOVER_TIME
logs_found = False
for fd in audit.AuditLogsForTimespan(start_time, now, token):
logs_found = True
for event in fd.GenerateItems():
if now - offset < event.timestamp < now:
yield event
if not logs_found:
raise ValueError("Couldn't find any logs in aff4:/audit/logs "
"between %s and %s" % (start_time, now))
