campus.sysnort
Class SysnortSensor

java.lang.Object
  |
  +--campus.sysnort.SysnortSensor
All Implemented Interfaces:
EndPoint, LogTracer.TracerObserver, Publisher, SyslogConstants

public class SysnortSensor
extends java.lang.Object
implements Publisher, LogTracer.TracerObserver, SyslogConstants

A Syslog source using Solar PACK service. The source can be subscribed by multiple Snort app, each may have multiple rules/plugins with respective PACK policies. The input is STDIN, either disregarding the temporal relation (non-stop) or respecting the message timestamp by setting command line option "-tracer true".

Version:
$Id: SysnortSensor.java,v 1.14 2003/10/07 01:13:23 glchen Exp $
Author:
Guanling Chen

Field Summary
private static org.apache.log4j.Logger _log
           
protected  serp.util.Options _opts
           
protected  PackService _pack
           
protected  boolean _tracer
           
 
Fields inherited from interface campus.syslog.SyslogConstants
BASE, EVT_ACTION, EVT_APNAME, EVT_CLIENTHOST, EVT_CLIENTMAC, EVT_DAY, EVT_MONTH, EVT_MSGTYPE, EVT_NOTE, EVT_TIME, EVT_TIMESTAMP, EVT_YEAR, IDX_ACTION, IDX_APNAME, IDX_CLIENTHOST, IDX_CLIENTMAC, IDX_DAY, IDX_MONTH, IDX_MSGTYPE, IDX_NOTE, IDX_TIME, IDX_TIMESTAMP, IDX_YEAR, TAG_ASSOCIATED, TAG_AUTHENTICATED, TAG_DEASSOCIATING, TAG_DEASSOCIATION, TAG_DEAUTHENTICATING, TAG_DEAUTHENTICATION, TAG_FATAL, TAG_INACTIVITY, TAG_INFO, TAG_REASSOCIATED, TAG_REPEAT_LAST_MSG, TAG_ROAMED, TAG_SYSLOG, TAG_WARNING
 
Constructor Summary
SysnortSensor(serp.util.Options opts)
           
 
Method Summary
 void handleMessage(java.lang.String msg)
          feed the output to the observer.
static void main(java.lang.String[] args)
           
 void run()
           
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

_log

private static org.apache.log4j.Logger _log

_opts

protected serp.util.Options _opts

_tracer

protected boolean _tracer

_pack

protected PackService _pack
Constructor Detail

SysnortSensor

public SysnortSensor(serp.util.Options opts)
              throws java.lang.Exception
Method Detail

run

public void run()
         throws java.lang.Exception
java.lang.Exception

handleMessage

public void handleMessage(java.lang.String msg)
                   throws java.lang.Exception
Description copied from interface: LogTracer.TracerObserver
feed the output to the observer.

Specified by:
handleMessage in interface LogTracer.TracerObserver
java.lang.Exception

main

public static void main(java.lang.String[] args)
                 throws java.lang.Exception
java.lang.Exception