<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV>Hello,</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>While diagnosing avc messages, I found the log message too spread-out to form a mental picture, </DIV><DIV>since the lack of some rules often result in several domain domains barking. This reminds me of</DIV><DIV>unforgiving Ada compilers spilling out loads of messages. I did not want to use audit2allow </DIV><DIV>too quickly until I understood what the machine is not happy with. So, I needed a message </DIV><DIV>format that let me to that.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Here is a simple perl script to parse log files for avc denial messages, index, sort them, and print them </DIV><DIV>in tree (single depth) view, which I hastily put together last night. I hope it will help others as it did </DIV><DIV>for me. Please feel free to modify it for your own use.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>You can index the message by any key, for example scontext, tcontext, action, name and etc. You can</DIV><DIV>also specify the log files to parse. By default, the script trim the context string of the _u, _r and _t, which</DIV><DIV>are good for rule readability in source files, but clutter diagnostic print out. However, if this bothers you,</DIV><DIV>disable trimming by --trim=no option. To get help and condition of usage, avctree --help. It is </DIV><DIV>best to pipe the output to less so that you can navigate.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>A typical partial print out is as follows (this one indexed by tcontext): </DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><FONT class="Apple-style-span" face="Courier New"># --------------------------------------------------------------------------------[tcontext]</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">|</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">+-[root-object-default ]</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- system-system-initrc_su su(1753) : dir : search : home : dm-0 : 49182</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">|</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">+-[root-object-selinux_config]</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- root-system-semanage semodule(3584) : dir : rename : active : sdb1 : 49833</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">|</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">+-[root-object-user_home ]</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- root-system-semanage semodule(10359) : lnk_file : read : targeted : sdb1 : 98758</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- root-system-semanage semodule(11006) : lnk_file : read : policy : sdb1 : 98764</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- root-system-semanage semodule(3584) : lnk_file : read : targeted : sdb1 : 98758</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">|</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">+-[system-object-default ]</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- system-system-initrc_su su(1753) : dir : search : / : dm-0 : 2</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">| +<- system-system-hald hald(1958) : dir : getattr : / : dm-0 : 2</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New">|</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><BR class="khtml-block-placeholder"></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><BR class="khtml-block-placeholder"></FONT></DIV><DIV>No PP module for this script yet. This script use basic Perl features, so, as along you have base Perl package installed, it should work.</DIV><DIV>Be happy to hear any comments or suggestion for improving this.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>/ks</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><FONT class="Apple-style-span" face="Courier New">#------------------------------------------- cut here -----------------------------------------</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#!/usr/bin/perl -w</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">sub lmsg </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">{</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print <<LMSG;;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Copyright (C) 2007, LEE, "Kok Seng" (kokseng at ieee dot org)</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># This program is free software; you can redistribute it and/or</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># modify it under the terms of the GNU General Public License as</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># published by the Free Software Foundation; either version 2 of</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># the License, or (at your option) any later version.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># This program is distributed in the hope that it will be useful,</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># but WITHOUT ANY WARRANTY; without even the implied warranty of</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># GNU General Public License for more details.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># You should have received a copy of the GNU General Public License</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># along with this program; if not, write to the Free Software</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># 02111-1307 USA</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">LMSG</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $version='1.0.0';</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">use strict;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">use warnings;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $thisScript = $0;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$thisScript =~ s#([^/]+[/]|)(\w+)#$2#;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">use Getopt::Long;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">sub usage</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">{</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">lmsg;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print "Usage:\n";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print <<USAGETXT;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">Utility to format avc messages for readability</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">--------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$thisScript [[options] ...]</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">Options:</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> --log=[ all | file,...] : List log files to parse, delimited by comma.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> no argument or all => /var/log/messages, /var/log/kernel</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> --tags : Show time and audit tags</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> --key=key,... : List messages indexed-sorted by specified key</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> no argument or all => all keys </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Not specified => scontext,tcontext,action,comm,name</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> --trim=yes|no|1|0 : Trim context string. Default: yes </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">--help</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">--------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Examples:</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> a. $thisScript --key=scontext </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by source context.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> b. $thisScript --key=tcontext</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by target context.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> c. $thisScript --key=comm</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by command executed.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> d. $thisScript --key=name</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by target object's name.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> e. $thisScript --key=all or $thisScript --key</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by all keys.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> f. $thisScript </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages indexed-sorted by scontext, tcontext, comm, name (default)</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> g. $thisScript --trim=no</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages without trimming context string.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> h. $thisScript --log=/var/log/messages,/var/log/messages.1,/var/log/messages.2</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages from log files listed (delimited by comma).</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> i. $thisScript --tags</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"> Print avc messages, including in each message the log time tag and audit tag.</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">USAGETXT</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">exit -1;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $logARG;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Log files to parse</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $tagsARG;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Show time and audit tags</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $catARG;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Categories to print</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $helpARG;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Help</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $trimARG;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Trim context string for readability</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">usage(), exit unless GetOptions(</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">'log:s'</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">=></SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">\$logARG,</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">'tags!'</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">=></SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">\$tagsARG,</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">'key:s'</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">=></SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">\$catARG,</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">'trim:s'</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">=> \$trimARG,</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">'help!'</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">=></SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">\$helpARG</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">);</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">usage() if (defined($helpARG));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Option: skip tags</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $skiptags = defined($tagsARG)?0:1;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Option: log files</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my @logOPT</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">= grep -d $_, split /,|\n|\r/, $logARG if (defined($logARG));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">@logOPT = ('/var/log/messages','/var/log/kernel','/var/log/debug') </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">if (defined($logARG) && ((!scalar @logOPT) || grep /all/, @logOPT));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">@logOPT = ('/var/log/kernel') if (!scalar @logOPT && -d '/var/log/kernel');</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">@logOPT = ('/var/log/messages') if (!scalar @logOPT);</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Option: Category</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my @catOPT</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">= split /,|\n|\r/, $catARG if (defined($catARG));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my @catDEF = ('scontext','tcontext','comm','name'); </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Option: Trim</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $trimOPT</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">= defined($trimARG) ? ($trimARG =~ /no|0|/i ? 0 : 1 ) : 1;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Regular expression for parsing avc's 'denied' messages</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $avcRE = qr/^(\w{3}\s+\d{2}\s+\d{2}:\d{2}:\d{2})[\s\w]+:\s*audit$([\d.:]+)$\s*:\s*avc\s*:\s*denied\s+\{\s+(\w+)\s+}\s+for\s+(.*)/;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## Holds indexed avc message records</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my %avc;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## contextFMT</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># </SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">Format context string for readability</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">sub contextFMT</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">{</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $ctxt = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my ($u,$r,$t,$l) = split /:/, $ctxt;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$u =~ s/(.*)_./$1/;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$r =~ s/(.*)_./$1/;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$t =~ s/(.*)_./$1/;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">return $u . '-' . $r . '-' . $t;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## readLOG log-file-name</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># </SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">Reads the specified log file</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">sub readLOG </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">{</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $avc = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $logfile = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $logsn = ($logfile =~ /.*\/(.*)$/)[0];</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $tmax = defined($avc->{'_tcontext_max_'})?$avc->{'_tcontext_max_'}:0; </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $smax = defined($avc->{'_scontext_max_'})?$avc->{'_scontext_max_'}:0; </SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">open LOGF, '<' . $logfile || die "Cannot open input file: $logfile";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">while (<LOGF>) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">s/\r|\n//g;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!$_);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!/\s+avc:\s+/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my ($timetag, $audit, $action, $detail) = ($_ =~ /$avcRE/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!defined($action)||!defined($detail)||!defined($timetag)||!defined($audit));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># okay, we have a avc 'denied' message</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my %this;</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># this hash will keep the message's key=value</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my @fields = split /\s|\r|\n/, $detail;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">foreach (@fields) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!$_);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my ($key,$val) = split/=/;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!$key||!$val);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$val =~ s/[\"\']*([^\"\']*)[\"\']*/$1/;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{"$key"} = $val;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (!defined($this{'scontext'}) || !defined($this{'tcontext'}));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'action'} = $action;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'timetag'} = $timetag;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'audit'} = $audit;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'file'}= $logsn;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">if ($trimOPT) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'scontext'} = contextFMT($this{'scontext'});</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$this{'tcontext'} = contextFMT($this{'tcontext'});</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$smax = length($this{'scontext'}) if ($smax < length($this{'scontext'}));</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$tmax = length($this{'tcontext'}) if ($tmax < length($this{'tcontext'}));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Okay, let's index the records with various keys</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">foreach (keys %this) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if (/audit|timetag|file/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$avc->{$_} = {} if (!defined($avc->{$_}));</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$avc->{$_}->{$this{$_}} = [()] if (!defined($avc->{$_}->{$this{$_}}));</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">push @{$avc->{$_}->{$this{$_}}}, \%this;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">close LOGF;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$avc->{'_scontext_max_'} = $smax;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$avc->{'_tcontext_max_'} = $tmax;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">##</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># keyTREE key</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">#</SPAN></FONT><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">Show selected key in a tree view</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">sub keyTREE</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">{</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $avc = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $kcat = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $showfile = shift;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $hcat = $avc->{$kcat};</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $lvl = 1;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $isSctx = ($kcat =~ /scontext/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $isTctx = ($kcat =~ /tcontext/);</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $smax = $isSctx ? 0 : $avc->{'_scontext_max_'};</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $tmax = $isTctx ? 0 : $avc->{'_tcontext_max_'};</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">return if (/_scontext_max_|_tcontext_max_/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print "\n# "; for ($_=0; $_ < 80; $_++) {print "-";}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print "[", $kcat, "]\n";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">foreach my $kmsg (sort keys %$hcat) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">printf "|\n+-[%-*s]\n", $smax, $hcat->{$kmsg}[0]->{$kcat}; </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$lvl++;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $buf; </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $i;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">my $cnt = scalar @{$hcat->{$kmsg}};</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">foreach my $hmsg (@{$hcat->{$kmsg}}) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$buf .= sprintf "%s %-*s %s %-*s %s%s(%s) : %s : %s %s%s%s\n", </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$isTctx? '+<-' : '+->',</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$smax, $isSctx?'':$hmsg->{'scontext'}, </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$isTctx||$isSctx ? '' : '-+->',</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$tmax, $isTctx?'':$hmsg->{'tcontext'}, </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">defined($showfile)? $hmsg->{'file'}.'> ':'', </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$hmsg->{'comm'}, $hmsg->{'pid'}, $hmsg->{'tclass'}, </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$hmsg->{'action'}, </SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">defined($hmsg->{'name'})?': '.$hmsg->{'name'}:'',</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">defined($hmsg->{'key'})?' : '.$hmsg->{'key'}:'',</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">defined($hmsg->{'dev'})?' : '.$hmsg->{'dev'} . (defined($hmsg->{'ino'})?' : '.$hmsg->{'ino'}:'') : ''</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$i = $lvl; $buf = '| ' . $buf while (--$i); print $buf; $buf = "";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">foreach my $kmsg (sort keys %$hmsg) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if ($kmsg =~ /file|scontext|tcontext|comm|pid|tclass|action|name|dev|ino|key|$kcat/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">next if ($skiptags && $kmsg =~ /timetag|audit/);</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$buf .= sprintf "%s=%s ", $kmsg, $hmsg->{$kmsg};</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">if ($buf) {</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$buf = sprintf "%*s%s\n", ($cnt==1)?$smax+$tmax+10+2:$smax+$tmax+10, ,"", $buf;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$i = (--$cnt)? $lvl:$lvl-1; $buf = '| ' . $buf while ($i--); print $buf; $buf = "";</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$lvl--;</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">$lvl--;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">}</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Parse log files</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">readLOG(\%avc, $_) foreach (@logOPT);</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># Decide which category to print</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">@catOPT = (sort keys %avc) if (defined($catARG) && (! scalar @catOPT) || grep /all/,@catOPT ) ;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">@catOPT = @catDEF if (!defined($catARG));</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print "\n> Copyright (C) 2007, LEE, \"Kok Seng\" (kokseng at ieee dot org)";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">print "\n> Notice: get help and condition of usage inforamtion regarding this script: $thisScript --help\n";</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">keyTREE(\%avc, $_,scalar @logOPT > 1?1:undef) foreach (@catOPT);</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">## ----------------------------------------------------------------------------------------------</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"># vim :ts=4:sw=4:</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;">1;</SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier New"><BR class="khtml-block-placeholder"></FONT></DIV><DIV><BR class="khtml-block-placeholder"></DIV></BODY></HTML>