Skip to content

Instantly share code, notes, and snippets.

@joenorton8014
Created October 11, 2018 20:54
Show Gist options
  • Save joenorton8014/cb16c3fc8ad7f56afca03768ead91abf to your computer and use it in GitHub Desktop.
Save joenorton8014/cb16c3fc8ad7f56afca03768ead91abf to your computer and use it in GitHub Desktop.
#!/usr/bin/python3
import time
from datetime import datetime
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from pathlib import Path
'''
Not very user friendly at this point....
Run this as a cron to monitor log files for certain activity.
*/4 * * * * /usr/bin/python3 /scripts/logmonitor.py
'''
def Get_Current_Time():
day = time.strftime("%Y%m%d_")
clock = time.strftime("%H%M%S")
timestamp = day+clock
time_obj = datetime.strptime(timestamp[:19], "%Y%m%d_%H%M%S")
return time_obj
def sendnotificationmail(subject,email_contents):
gmail_user = ''
gmail_password = ''
to_email = ''
# create message object
msg = MIMEMultipart()
# fill in all the normal email parts
msg['Subject'] = subject
msg['From'] = gmail_user
msg['To'] = to_email
SERVER = "smtp.gmail.com:465"
body = email_contents
msg.attach(MIMEText(body))
server = smtplib.SMTP_SSL(SERVER)
server.ehlo()
server.login(gmail_user , gmail_password)
server.sendmail(msg['From'], msg['To'], msg.as_string())
server.quit()
def Log_File_Search(log_file,search_term):
search_results = []
file_to_search = Path(log_file)
if file_to_search.is_file():
with open(file_to_search) as log_to_search:
for line in log_to_search:
if search_term in line:
search_results.append(line)
else:
# If the log file doesn't exist, note that in the results
search_results.append(log_file + ' not found!')
return search_results
# Function for parsing through Ubuntu auth.log and syslog timestamps
# Sep 13 11:13:59 kali-pontiac sshd[4835]: Accepted password for root from 10.0.0.100 port 63208 ssh2
def Get_Events_in_Hour(search_results):
events_dict = {}
for result in search_results:
year = time.strftime("%Y")
month = time.strftime("%m")
day = result.split(" ")[1]
hourminute = result.split(" ")[2].replace(':','')
log_timestamp = year + month + day + '_' + hourminute
time_key = datetime.strptime(log_timestamp[:19], "%Y%m%d_%H%M%S")
time_diff = current_time - time_key
time_diff_mins = int(round(time_diff.total_seconds() / 60))
if time_diff_mins < 5:
events_dict[time_key] = result
else:
pass
return events_dict
#log_file = '/var/log/auth.log'
#search_term = 'Accepted'
current_time = Get_Current_Time()
search_dictionary = {}
search_dictionary['/var/log/auth.log'] = 'Accepted'
search_dictionary['/var/log/syslog'] = 'SENT CONTROL'
for log_file in search_dictionary:
search_term = search_dictionary[log_file]
search_results = Log_File_Search(log_file,search_term)
if len(search_results) == 0:
pass
else:
last_hour = Get_Events_in_Hour(search_results)
if len(last_hour) > 0:
subject = 'Activity for \"' + search_term + '\" in ' + log_file + ' - ' + str(current_time)
email_contents = ''
for log_entry in last_hour.values():
email_contents += log_entry
sendnotificationmail(subject,email_contents)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment