elB4RTO/LogDoctor
elB4RTO
/
LogDoctor
2
2
Fork 0
Code Issues 6 Pull Requests Projects 1 Releases 8 Wiki Activity

Improved Nginx LogFormat handling

This commit is contained in:
Valentino Orlandi 2022-08-12 22:16:09 +02:00
parent 6f1c46b473
commit 19ad24156c
Signed by: elB4RTO
GPG Key ID: 1719E976DB2D4E71
2 changed files with 29 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
logdoctor/tools/craplog/modules/formats.cpp
View File

@ -127,8 +127,8 @@ const std::string FormatOps::parseNginxEscapes( const std::string& string )
cc = string.at( i+1 );
if ( c == '\\' ) {
// just the ones supported by nginx
if ( cc == '\\' ) {
str.push_back( c );
if ( cc == '\\' || cc == '\'' || cc == '"' ) {
str.push_back( cc );
i++;
} else if ( cc == 'n' ) {
str.push_back( '\n' );
@ -139,9 +139,6 @@ const std::string FormatOps::parseNginxEscapes( const std::string& string )
} else if ( cc == 't' ) {
str.push_back( '\t' );
i++;
} else if ( cc == '\'' || cc == '"' ) {
str.push_back( cc );
i++;
} else {
// not a control-character, resulting in a backslash+character
str.push_back( c );
@ -515,30 +512,45 @@ const FormatOps::LogsFormat FormatOps::processNginxFormatString( const std::stri
aux = f_str.find( '$', start );
if ( aux < 0 || aux > max ) {
// not found, append as final and stop searching
final = f_str.substr( start );
final = this->parseNginxEscapes( f_str.substr( start ) );
break;
}
aux ++;
// find the end of the current field
stop = this->findNginxFieldEnd( f_str, aux );
if ( stop == max ) {
// this is the last field
stop = this->findNginxFieldEnd( f_str, aux ) + 1;
if ( stop > max ) {
// this is the last field, and ther's no final separator
finished = true;
}
cur_sep = f_str.substr( start, aux-start-1 );
cur_fld = f_str.substr( aux, stop-aux+1 );
cur_fld = f_str.substr( aux, stop-aux );
// fixes for varnames
if ( StringOps::startsWith( cur_fld, "cookie_" ) ) {
cur_fld = "cookie_";
} else if ( StringOps::startsWith( cur_fld, "http_" )
&& cur_fld != "http_user_agent" && cur_fld != "http_referer" ) {
cur_fld = "http_";
} else if ( StringOps::startsWith( cur_fld, "arg_" ) ) {
cur_fld = "arg_";
} else if ( StringOps::startsWith( cur_fld, "sent_http_" ) ) {
cur_fld = "sent_http_";
} else if ( StringOps::startsWith( cur_fld, "upstream_cookie_" ) ) {
cur_fld = "upstream_cookie_";
} else if ( StringOps::startsWith( cur_fld, "upstream_http_" ) ) {
cur_fld = "upstream_http_";
}
// check if the field is valid
if ( f_map.find( cur_fld ) != f_map.end()
|| StringOps::startsWith( cur_fld, "cookie_" ) ) {
if ( f_map.find( cur_fld ) != f_map.end() ) {
// valid, append
separators.push_back( cur_sep );
if ( StringOps::startsWith( cur_fld, "cookie_" ) ) {
fields.push_back( "cookie" );
if ( start == 0 ) {
initial = this->parseNginxEscapes( cur_sep );
} else {
fields.push_back( f_map.at( cur_fld ) );
separators.push_back( this->parseNginxEscapes( cur_sep ) );
}
fields.push_back( f_map.at( cur_fld ) );
if ( finished == true ) {
// this was the last field
break;

2
logdoctor/tools/craplog/modules/formats.h
View File

@ -203,7 +203,7 @@ private:
{"request_length", "bytes_received"},
{"request_time", "time_taken_s.ms"},
{"http_referer", "referer"},
/*{"cookie_", "cookie"},*/
{"cookie_", "cookie"},
{"http_user_agent", "user_agent"},
// not in use, will be discarded
{"ancient_browser", "NONE"},