AuditLogDirectParser implements AuditCommandParser { @Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = logLineParseRegex.matcher(inputLine.toString()); if (!m.find()) { throw new IOException( "Unable to find valid message pattern from audit log line: `" + inputLine + "` using regex `" + logLineParseRegex + "`"); } long relativeTimestamp; try { relativeTimestamp = dateFormat.parse(m.group("timestamp")).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException( "Exception while parsing timestamp from audit log line: `" + inputLine + "`", p); } String auditMessageSanitized = m.group("message").replace("(options=", "(options:"); Map<String, String> parameterMap = new HashMap<String, String>(); String[] auditMessageSanitizedList = auditMessageSanitized.split("\t"); for (String auditMessage : auditMessageSanitizedList) { String[] splitMessage = auditMessage.split("=", 2); try { parameterMap.put(splitMessage[0], splitMessage[1]); } catch (ArrayIndexOutOfBoundsException e) { throw new IOException( "Exception while parsing a message from audit log line: `" + inputLine + "`", e); } } return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); }  @Override void initialize(Configuration conf); @Override AuditReplayCommand parse(Text inputLine,
      Function<Long, Long> relativeToAbsolute); static final String AUDIT_START_TIMESTAMP_KEY; static final String AUDIT_LOG_DATE_FORMAT_KEY; static final String AUDIT_LOG_DATE_FORMAT_DEFAULT; static final String AUDIT_LOG_DATE_TIME_ZONE_KEY; static final String AUDIT_LOG_DATE_TIME_ZONE_DEFAULT; static final String AUDIT_LOG_PARSE_REGEX_KEY; static final String AUDIT_LOG_PARSE_REGEX_DEFAULT; }
@Test public void testSimpleInput() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "fakeUser", "listStatus", "sourcePath", "null"); AuditReplayCommand expected = new AuditReplayCommand(1000, "fakeUser", "listStatus", "sourcePath", "null", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }
@Test public void testInputWithEquals() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "fakeUser", "listStatus", "day=1970", "null"); AuditReplayCommand expected = new AuditReplayCommand(1000, "fakeUser", "listStatus", "day=1970", "null", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }
@Test public void testInputWithRenameOptions() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "fakeUser", "rename (options=[TO_TRASH])", "sourcePath", "destPath"); AuditReplayCommand expected = new AuditReplayCommand(1000, "fakeUser", "rename (options=[TO_TRASH])", "sourcePath", "destPath", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }
@Test public void testInputWithTokenAuth() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "fakeUser (auth:TOKEN)", "create", "sourcePath", "null"); AuditReplayCommand expected = new AuditReplayCommand(1000, "fakeUser", "create", "sourcePath", "null", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }
@Test public void testInputWithProxyUser() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "proxyUser (auth:TOKEN) via fakeUser", "create", "sourcePath", "null"); AuditReplayCommand expected = new AuditReplayCommand(1000, "proxyUser", "create", "sourcePath", "null", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }
@Test public void testParseDefaultDateFormat() throws Exception { Text in = getAuditString("1970-01-01 13:00:00,000", "ignored", "ignored", "ignored", "ignored"); AuditReplayCommand expected = new AuditReplayCommand( 13 * 60 * 60 * 1000 - START_TIMESTAMP, "ignored", "ignored", "ignored", "ignored", "0.0.0.0"); assertEquals(expected, parser.parse(in, Function.identity())); }