HBaseAuditLogParser implements Serializable { public HBaseAuditLogObject parse(String logLine) { if(logLine == null || logLine.isEmpty()) return null; HBaseAuditLogObject ret = new HBaseAuditLogObject(); String timestamp = ""; String user = ""; String scope = ""; String action = ""; String ip = ""; String request = ""; String family = ""; String context = ""; Matcher loggerMatcher = loggerPattern.matcher(logLine); if(loggerMatcher.find()) { try { timestamp = loggerMatcher.group(LOGDATE_INDEX); String [] attrs = loggerMatcher.group(LOGATTRS_INDEX).split(";"); ret.status = allowedPattern.matcher(attrs[0]).find() ? ALLOWED : DENIED; try { ip = attrs[2].split(":")[1].trim(); } catch (Exception e) { ip = ""; } try { request = attrs[3].split(":")[1].trim(); } catch (Exception e) { request = ""; } try { context = attrs[4].trim(); } catch (Exception e) { context = ""; } Matcher contextMatcher = loggerContextPattern.matcher(context.replaceAll("\\s+","")); if(contextMatcher.find()) { boolean paramsOpen = false; List<String> kvs = new LinkedList<String>(Arrays.asList(contextMatcher.group(1).split(","))); while (!kvs.isEmpty()) { String kv = kvs.get(0); if (kv.split("=").length < 2) { kvs.remove(0); continue; } String k = kv.split("=")[0]; String v = kv.split("=")[1]; if (paramsOpen && kv.substring(kv.length() - 1).equals("]")) { paramsOpen = false; v = v.substring(0, v.length() - 1); } switch (k) { case "user": user = v; break; case "scope": scope = v; break; case "family": family = v; break; case "action": action = v; break; case "params": kvs.add(v.substring(1) + "=" + kv.split("=")[2]); paramsOpen = true; break; default: break; } kvs.remove(0); } } if(StringUtils.isNotEmpty(family)) { if(!scope.contains(":")) scope = "default:" + scope; scope = String.format("%s:%s", scope, family); } if(StringUtils.isNotEmpty(ip)) { ret.host = ip.substring(1); } ret.timestamp = DateTimeUtil.humanDateToMilliseconds(timestamp); ret.scope = scope; ret.action = action; ret.user = LogParseUtil.parseUserFromUGI(user); ret.request = request; return ret; } catch(Exception e) { LOG.error("Got exception when parsing audit log:" + logLine + ", exception:" + e.getMessage(), e); } } return null; }  HBaseAuditLogObject parse(String logLine);  }
@Test public void test() throws Exception { String log = "2015-08-11 13:31:03,729 TRACE SecurityLogger.org.apache.hadoop.hbase.security.access.AccessController: Access allowed for user eagle; reason: Table permission granted; remote address: /127.0.0.1; request: get; context: (user=eagle,scope=hbase:namespace,family=info, action=READ)"; HBaseAuditLogObject obj = parser.parse(log); Assert.assertEquals(obj.action, "READ"); Assert.assertEquals(obj.host, "127.0.0.1"); Assert.assertEquals(obj.scope, "hbase:namespace:info"); }
@Test public void test2() throws Exception { String log = "2015-08-04 12:29:03,073 TRACE SecurityLogger.org.apache.hadoop.hbase.security.access.AccessController: Access allowed for user eagle; reason: Global check allowed; remote address: ; request: preOpen; context: (user=eagle, scope=GLOBAL, family=, action=ADMIN)"; HBaseAuditLogObject obj = parser.parse(log); Assert.assertEquals(obj.action, "ADMIN"); Assert.assertEquals(obj.host, ""); Assert.assertEquals(obj.scope, "GLOBAL"); }