OwlCyberSecurity - MANAGER
Edit File: journal.cpython-36.pyc
3 ��X�V � " @ s� d dl mZ d dlZd dlZd dlZd dlZ d dl Z d dl Z d dlmZmZmZmZmZmZmZmZ ejd(krzd dlmZ ddlm Z m Z m Z ddl m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z* dd l+m,Z- ejd)kr�dd l m.Z. ne/Z.d d � Z0d d� Z1dd� Z2dd� Z3dd� Z4ejd*k�r(dd� Z5nej6Z5e5e5e5e7e7e7e7e7e7e7e7e7e7e7e7e7e7e7e7e7e7e3e2e1e0e4e8e7e7e7e7e7e3d�!Z9e:d�Z;dd� Z<G dd � d e �Z=d d � Z>d d � Z?d+d!d"�Z@ded#fd$d%�ZAG d&d'� d'e jB�ZCdS ),� )�divisionN)� LOG_EMERG� LOG_ALERT�LOG_CRIT�LOG_ERR� LOG_WARNING� LOG_NOTICE�LOG_INFO� LOG_DEBUG� )�ChainMap� )� __version__�sendv� stream_fd) �_Reader�NOP�APPEND� INVALIDATE� LOCAL_ONLY� RUNTIME_ONLY�SYSTEM� SYSTEM_ONLY� CURRENT_USER�OS_ROOT� _get_catalog)�id128)� Monotonicc C s$ t tj| d d�tj| d d�f�S )Nr )� microsecondsr )�bytes)r � _datetime� timedelta�_uuid�UUID)�m� r% � /usr/lib64/python3.6/journal.py�_convert_monotonic0 s r' c C s t jt| �d�S )N)r )r r! �int)�sr% r% r& �_convert_source_monotonic5 s r* c C s t jj| d �S )Ni@B )r �datetime� fromtimestamp)�tr% r% r& �_convert_realtime9 s r. c C s t jjt| �d �S )Ni@B )r r+ r, r( )r) r% r% r& �_convert_timestamp= s r/ c C s | S )Nr% )�xr% r% r& �_convert_trivialA s r1 c C s t j| j� �S )N)r" r# �decode)r) r% r% r& � _convert_uuidE s r3 )!� MESSAGE_ID� _MACHINE_ID�_BOOT_ID�PRIORITYZLEADERZ SESSION_IDZUSERSPACE_USECZ INITRD_USECZ KERNEL_USECZ_UIDZ_GIDZ_PIDZSYSLOG_FACILITYZ SYSLOG_PIDZ_AUDIT_SESSIONZ_AUDIT_LOGINUIDZ_SYSTEMD_SESSIONZ_SYSTEMD_OWNER_UID� CODE_LINEZERRNOZ EXIT_STATUSZ_SOURCE_REALTIME_TIMESTAMP�__REALTIME_TIMESTAMPZ_SOURCE_MONOTONIC_TIMESTAMP�__MONOTONIC_TIMESTAMP�__CURSORZCOREDUMPZ COREDUMP_PIDZ COREDUMP_UIDZ COREDUMP_GIDZCOREDUMP_SESSIONZCOREDUMP_SIGNALZCOREDUMP_TIMESTAMPZ%ABCDEFGHIJKLMNOPQRTSUVWXYZ_0123456789c C s t | �t S )N)�set�_IDENT_CHARACTER)r) r% r% r& �_valid_field_nameq s r> c s� e Zd ZdZd%� fdd� Zdd� Zdd� Zd d � Zd d � Ze j d&k rHeZ � fdd�Z d'� fdd� Z d(dd�Z� fdd�Zd)� fdd� Z� fdd�Zd*� fdd � Zd d � Zd d � Zd+d!d"�Zd,d#d$�Z� ZS )-�Readera� Access systemd journal entries. Entries are subject to filtering and limits, see `add_match`, `this_boot`, `this_machine` functions and the `data_treshold` attribute. Note that in order to access the system journal, a non-root user must have the necessary privileges, see journalctl(1) for details. Unprivileged users can access only their own journal. Example usage to print out all informational or higher level messages for systemd-udevd for this boot: >>> from systemd import journal >>> j = journal.Reader() >>> j.this_boot() >>> j.log_level(journal.LOG_INFO) >>> j.add_match(_SYSTEMD_UNIT="systemd-udevd.service") >>> for entry in j: # doctest: +SKIP ... print(entry['MESSAGE']) starting version ... See systemd.journal-fields(7) for more info on typical fields found in the journal. Nc s� |dkr"|dkr |dkr t }nd}tt| �j|||� tjdkrnt� | _|dk r^| jjj |� | jjj t � n t j � | _|dk r�| jj |� dS )a� Create a new Reader. Argument `flags` defines the open flags of the journal, which can be one of, or ORed combination of constants: LOCAL_ONLY (default) opens journal on local machine only; RUNTIME_ONLY opens only volatile journal files; and SYSTEM_ONLY opens only journal files of system services and the kernel. Argument `path` is the directory of journal files, either a file system path or a file descriptor. Note that `flags`, `path`, and `files` are exclusive. Argument `converters` is a dictionary which updates the DEFAULT_CONVERTERS to convert journal field values. Field names are used as keys into this dictionary. The values must be single argument functions, which take a `bytes` object and return a converted value. When there's no entry for a field name, then the default UTF-8 decoding will be attempted. If the conversion fails with a ValueError, unconverted bytes object will be returned. (Note that ValueEror is a superclass of UnicodeDecodeError). Reader implements the context manager protocol: the journal will be closed when exiting the block. Nr r )r r ) r �superr? �__init__�_sys� version_info� _ChainMap� converters�maps�append�DEFAULT_CONVERTERS�copy�update)�self�flags�path�filesrE )� __class__r% r& rA � s zReader.__init__c C s2 | j j|tj�}y||�S tk r, |S X dS )a/ Convert value using self.converters[key]. If `key` is not present in self.converters, a standard unicode decoding will be attempted. If the conversion (either key-specific or the default one) fails with a ValueError, the original bytes object will be returned. N)rE �getr r2 � ValueError)rK �key�valueZconvertr% r% r& �_convert_field� s zReader._convert_fieldc sR i }xH|j � D ]<\� }t|t�r:� �fdd�|D �|� < q�j� |�|� < qW |S )z6Convert entire journal entry utilising _convert_field.c s g | ]}�j � |��qS r% )rT )�.0�val)rR rK r% r& � <listcomp>� s z)Reader._convert_entry.<locals>.<listcomp>)�items� isinstance�listrT )rK �entry�resultrS r% )rR rK r& �_convert_entry� s zReader._convert_entryc C s | S )z=Return self. Part of the iterator protocol. r% )rK r% r% r& �__iter__� s zReader.__iter__c C s | j � }|r|S t� �dS )z�Return the next entry in the journal. Returns self.get_next() or raises StopIteration. Part of the iterator protocol. N)�get_next� StopIteration)rK Zansr% r% r& �__next__� s zReader.__next__r c sB t |�}|jdd� |j� D �� x |D ]}tt| �j|� q&W dS )aH Add one or more matches to the filter journal log entries. All matches of different field are combined with logical AND, and matches of the same field are automatically combined with logical OR. Matches can be passed as strings of form "FIELD=value", or keyword arguments FIELD="value". c s s | ]\}}t ||�V qd S )N)� _make_line)rU rR rV r% r% r& � <genexpr>� s z#Reader.add_match.<locals>.<genexpr>N)rZ �extendrX r@ r? � add_match)rK �args�kwargs�arg)rO r% r& re � s zReader.add_matchr c sV t t| �j|�rPt t| �j� }|rP| j� |d< | j� |d< | j� |d< | j|�S t� S )a� Return the next log entry as a dictionary. Entries will be processed with converters specified during Reader creation. Optional `skip` value will return the `skip`-th log entry. Currently a standard dictionary of fields is returned, but in the future this might be changed to a different mapping type, so the calling code should not make assumptions about a specific type. r9 r: r; ) r@ r? Z_nextZ_get_allZ _get_realtimeZ_get_monotonicZ _get_cursorr] �dict)rK �skipr[ )rO r% r& r_ � s zReader.get_nextc C s | j | �S )a� Return the previous log entry. Equivalent to get_next(-skip). Optional `skip` value will return the -`skip`-th log entry. Entries will be processed with converters specified during Reader creation. Currently a standard dictionary of fields is returned, but in the future this might be changed to a different mapping type, so the calling code should not make assumptions about a specific type. )r_ )rK rj r% r% r& � get_previous s zReader.get_previousc s$ t � �fdd�tt��j� �D ��S )z�Return a list of unique values appearing in the journal for the given `field`. Note this does not respect any journal matches. Entries will be processed with converters specified during Reader creation. c 3 s | ]}�j � |�V qd S )N)rT )rU rS )�fieldrK r% r& rc $ s z&Reader.query_unique.<locals>.<genexpr>)r< r@ r? � query_unique)rK rl )rO )rl rK r& rm s zReader.query_uniquec s( |dkr dn t |d �}tt| �j|�S )aE Wait for a change in the journal. `timeout` is the maximum time in seconds to wait, or None which means to wait forever. Returns one of NOP (no change), APPEND (new entries have been added to the end of the journal), or INVALIDATE (journal files have been added or removed). Nr i@B ���)r( r@ r? �wait)rK Ztimeout�us)rO r% r& ro ' s z Reader.waitc sJ t |tj�r$tt|jd��d �}nt |t�s:t|d �}tt| �j|�S )a( Seek to a matching journal entry nearest to `timestamp` time. Argument `realtime` must be either an integer UNIX timestamp (in microseconds since the beginning of the UNIX epoch), or an float UNIX timestamp (in seconds since the beginning of the UNIX epoch), or a datetime.datetime instance. The integer form is deprecated. >>> import time >>> from systemd import journal >>> yesterday = time.time() - 24 * 60**2 >>> j = journal.Reader() >>> j.seek_realtime(yesterday) z%s.%fi@B ) rY r r+ r( �floatZstrftimer@ r? � seek_realtime)rK Zrealtime)rO r% r& rr 4 s zReader.seek_realtimec sD t |tj�r|j� }t|d �}t |tj�r2|j}tt | �j ||�S )aG Seek to a matching journal entry nearest to `monotonic` time. Argument `monotonic` is a timestamp from boot in either seconds or a datetime.timedelta instance. Argument `bootid` is a string or UUID representing which boot the monotonic time is reference to. Defaults to current bootid. i@B ) rY r r! Z total_secondsr( r" r# �hexr@ r? �seek_monotonic)rK Z monotonic�bootid)rO r% r& rt I s zReader.seek_monotonicc C sL d| kodkn r@x.t |d �D ]}| jd| d� q&W ntd��dS )zASet maximum log `level` by setting matches for PRIORITY. r � r z%d)r7 z!Log level must be 0 <= level <= 7N)�rangere rQ )rK �level�ir% r% r& � log_levelX s zReader.log_levelc C s" t |tj�r|j}| j|d� dS )a Add match for log entries with specified `messageid`. `messageid` can be string of hexadicimal digits or a UUID instance. Standard message IDs can be found in systemd.id128. Equivalent to add_match(MESSAGE_ID=`messageid`). )r4 N)rY r" r# rs re )rK Z messageidr% r% r& �messageid_matcha s zReader.messageid_matchc C s0 |dkrt j� j}n t|d|�}| j|d� dS )z�Add match for _BOOT_ID for current boot or the specified boot ID. If specified, bootid should be either a UUID or a 32 digit hex number. Equivalent to add_match(_BOOT_ID='bootid'). Nrs )r6 )�_id128Zget_bootrs �getattrre )rK ru r% r% r& � this_bootm s zReader.this_bootc C s0 |dkrt j� j}n t|d|�}| j|d� dS )z�Add match for _MACHINE_ID equal to the ID of this machine. If specified, machineid should be either a UUID or a 32 digit hex number. Equivalent to add_match(_MACHINE_ID='machineid'). Nrs )r5 )r| Z get_machiners r} re )rK Z machineidr% r% r& � this_machinez s zReader.this_machine)NNNN)r )r )r )N)N)N)N)�__name__� __module__� __qualname__�__doc__rA rT r] r^ ra rB rC �nextre r_ rk rm ro rr rt rz r{ r~ r � __classcell__r% r% )rO r& r? u s& * r? c C s t | tj�r| j} t| �S )zlReturn catalog entry for the specified ID. `mid` should be either a UUID or a 32 digit hex number. )rY r" r# rs r )Zmidr% r% r& � get_catalog� s r� c C sF t |t�r | jd�d | S t |t�r2| d | S | d t|� S d S )Nzutf-8� =�=)rY r �encode�str)rl rS r% r% r& rb � s rb c K s� d| g}|dk r,t |d|�}|jd| � || koH| koHdkn rltjdd�d dd� \}}}|dk r�|jd | � |dk r�|jd j|�� |dk r�|jd | � |jd d � |j� D �� t|� S )aA Send a message to the journal. >>> from systemd import journal >>> journal.send('Hello world') >>> journal.send('Hello, again, world', FIELD2='Greetings!') >>> journal.send('Binary message', BINARY=b'\xde\xad\xbe\xef') Value of the MESSAGE argument will be used for the MESSAGE= field. MESSAGE must be a string and will be sent as UTF-8 to the journal. MESSAGE_ID can be given to uniquely identify the type of message. It must be a string or a uuid.UUID object. CODE_LINE, CODE_FILE, and CODE_FUNC can be specified to identify the caller. Unless at least on of the three is given, values are extracted from the stack frame of the caller of send(). CODE_FILE and CODE_FUNC must be strings, CODE_LINE must be an integer. Additional fields for the journal entry can only be specified as keyword arguments. The payload can be either a string or bytes. A string will be sent as UTF-8, and bytes will be sent as-is to the journal. Other useful fields include PRIORITY, SYSLOG_FACILITY, SYSLOG_IDENTIFIER, SYSLOG_PID. zMESSAGE=Nrs z MESSAGE_ID=� )�limitr r z CODE_FILE=zCODE_LINE={:d}z CODE_FUNC=c s s | ]\}}t ||�V qd S )N)rb )rU rR rV r% r% r& rc � s zsend.<locals>.<genexpr>)r} rG � _traceback� extract_stack�formatrd rX r )ZMESSAGEr4 � CODE_FILEr8 � CODE_FUNCrg rf �idr% r% r& �send� s " r� Fc C sT | dkr:t j s*t jd s*t jd dkr0d} n t jd } t| ||�}tj|dd�S )a� Return a file object wrapping a stream to journal. Log messages written to this file as simple newline sepearted text strings are written to the journal. The file will be line buffered, so messages are actually sent after a newline character is written. >>> from systemd import journal >>> stream = journal.stream('myapp') # doctest: +SKIP >>> res = stream.write('message...\n') # doctest: +SKIP will produce the following message in the journal:: PRIORITY=7 SYSLOG_IDENTIFIER=myapp MESSAGE=message... If identifier is None, a suitable default based on sys.argv[0] will be used. This interface can be used conveniently with the print function: >>> from __future__ import print_function >>> stream = journal.stream() # doctest: +SKIP >>> print('message...', file=stream) # doctest: +SKIP priority is the syslog priority, one of `LOG_EMERG`, `LOG_ALERT`, `LOG_CRIT`, `LOG_ERR`, `LOG_WARNING`, `LOG_NOTICE`, `LOG_INFO`, `LOG_DEBUG`. level_prefix is a boolean. If true, kernel-style log priority level prefixes (such as '<1>') are interpreted. See sd-daemon(3) for more information. Nr z-c�python�wr )rB �argvr �_os�fdopen)Z identifierZpriorityZ level_prefix�fdr% r% r& �stream� s "" r� c s@ e Zd ZdZejef� fdd� Zdd� Ze dd� �Z e Z � Z S )�JournalHandlera� Journal handler class for the Python logging framework. Please see the Python logging module documentation for an overview: http://docs.python.org/library/logging.html. To create a custom logger whose messages go only to journal: >>> import logging >>> log = logging.getLogger('custom_logger_name') >>> log.propagate = False >>> log.addHandler(JournalHandler()) >>> log.warning("Some message: %s", 'detail') Note that by default, message levels `INFO` and `DEBUG` are ignored by the logging framework. To enable those log levels: >>> log.setLevel(logging.DEBUG) To redirect all logging messages to journal regardless of where they come from, attach it to the root logger: >>> logging.root.addHandler(JournalHandler()) For more complex configurations when using `dictConfig` or `fileConfig`, specify `systemd.journal.JournalHandler` as the handler class. Only standard handler configuration options are supported: `level`, `formatter`, `filters`. To attach journal MESSAGE_ID, an extra field is supported: >>> import uuid >>> mid = uuid.UUID('0123456789ABCDEF0123456789ABCDEF') >>> log.warning("Message with ID", extra={'MESSAGE_ID': mid}) Fields to be attached to all messages sent through this handler can be specified as keyword arguments. This probably makes sense only for SYSLOG_IDENTIFIER and similar fields which are constant for the whole program: >>> JournalHandler(SYSLOG_IDENTIFIER='my-cool-app') <...JournalHandler ...> The following journal fields will be sent: `MESSAGE`, `PRIORITY`, `THREAD_NAME`, `CODE_FILE`, `CODE_LINE`, `CODE_FUNC`, `LOGGER` (name as supplied to getLogger call), `MESSAGE_ID` (optional, see above), `SYSLOG_IDENTIFIER` (defaults to sys.argv[0]). The function used to actually send messages can be overridden using the `sender_function` parameter. c sX t t| �j|� x |D ]}t|�std| ��qW d|krHtjd |d< || _|| _d S )NzInvalid field name: ZSYSLOG_IDENTIFIERr ) r@ r� rA r> rQ rB r� r� �_extra)rK rx Zsender_functionrg �name)rO r% r& rA , s zJournalHandler.__init__c C s� y�| j |�}| j|j�}| jj� }|jr2|j|d< |jrB|j|d< |jrVt|j�|d< |j |j � | j |ft |�|j |j |j|j|j|jd�|�� W n tk r� | j|� Y nX dS )a Write `record` as a journal event. MESSAGE is taken from the message provided by the user, and PRIORITY, LOGGER, THREAD_NAME, CODE_{FILE,LINE,FUNC} fields are appended automatically. In addition, record.MESSAGE_ID will be used if present. ZEXCEPTION_TEXTZEXCEPTION_INFOZ CODE_ARGS)r7 ZLOGGERZ THREAD_NAMEZ PROCESS_NAMEr� r8 r� N)r� � map_priority�levelnor� rI Zexc_text�exc_inforf r� rJ �__dict__r� r� Z threadNameZ processName�pathname�linenoZfuncName� ExceptionZ handleError)rK �record�msgZpriZextrasr% r% r& �emit8 s, zJournalHandler.emitc C sN | t jkrtS | t jkr tS | t jkr*tS | t jkr8tS | t j krFt S t S dS )z�Map logging levels to journald priorities. Since Python log level numbers are "sparse", we have to map numbers in between the standard levels too. N) �_logging�DEBUGr �INFOr ZWARNINGr ZERRORr ZCRITICALr r )r� r% r% r& r� ^ s zJournalHandler.map_priority) r� r� r� r� r� ZNOTSETr� rA r� � staticmethodr� Z mapPriorityr� r% r% )rO r& r� � s 2 & r� )r r )r )r )NNNN)DZ __future__r �sysrB r+ r Zuuidr" � tracebackr� �osr� Zloggingr� Zsyslogr r r r r r r r rC � collectionsr rD Z_journalr r r Z_readerr r r r r r r r r r r � r r| r �tupler' r* r. r/ r1 r3 r# r( r rH r< r= r> r? r� rb r� r� ZHandlerr� r% r% r% r& �<module> s� ( 4 /,