@Test public void testInputWithTokenAuth() throws Exception { Text in = getAuditString("1970-01-01 00:00:11,000", "fakeUser (auth:TOKEN)", "create", "sourcePath", "null"); AuditReplayCommand expected = new AuditReplayCommand(1000, "fakeUser", "create", "sourcePath", "null", "0.0.0.0"); assertEquals(expected, parser.parse(in, IDENTITY_FN)); }
@Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = MESSAGE_ONLY_PATTERN.matcher(inputLine.toString()); if (!m.find()) { throw new IOException("Unable to find valid message pattern from audit log line: " + inputLine); } long relativeTimestamp; try { relativeTimestamp = AUDIT_DATE_FORMAT.parse(m.group(1)).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException("Exception while parsing timestamp from audit log", p); } String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); }
AuditLogDirectParser implements AuditCommandParser { @Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = MESSAGE_ONLY_PATTERN.matcher(inputLine.toString()); if (!m.find()) { throw new IOException("Unable to find valid message pattern from audit log line: " + inputLine); } long relativeTimestamp; try { relativeTimestamp = AUDIT_DATE_FORMAT.parse(m.group(1)).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException("Exception while parsing timestamp from audit log", p); } String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); } }
AuditLogDirectParser implements AuditCommandParser { @Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = MESSAGE_ONLY_PATTERN.matcher(inputLine.toString()); if (!m.find()) { throw new IOException("Unable to find valid message pattern from audit log line: " + inputLine); } long relativeTimestamp; try { relativeTimestamp = AUDIT_DATE_FORMAT.parse(m.group(1)).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException("Exception while parsing timestamp from audit log", p); } String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); }  }
AuditLogDirectParser implements AuditCommandParser { @Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = MESSAGE_ONLY_PATTERN.matcher(inputLine.toString()); if (!m.find()) { throw new IOException("Unable to find valid message pattern from audit log line: " + inputLine); } long relativeTimestamp; try { relativeTimestamp = AUDIT_DATE_FORMAT.parse(m.group(1)).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException("Exception while parsing timestamp from audit log", p); } String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); }  @Override void initialize(Configuration conf); @Override AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute); }
AuditLogDirectParser implements AuditCommandParser { @Override public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute) throws IOException { Matcher m = MESSAGE_ONLY_PATTERN.matcher(inputLine.toString()); if (!m.find()) { throw new IOException("Unable to find valid message pattern from audit log line: " + inputLine); } long relativeTimestamp; try { relativeTimestamp = AUDIT_DATE_FORMAT.parse(m.group(1)).getTime() - startTimestamp; } catch (ParseException p) { throw new IOException("Exception while parsing timestamp from audit log", p); } String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), parameterMap.get("cmd").replace("(options:", "(options="), parameterMap.get("src"), parameterMap.get("dst"), parameterMap.get("ip")); }  @Override void initialize(Configuration conf); @Override AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToAbsolute); static final String AUDIT_START_TIMESTAMP_KEY; }