1 Star 0 Fork 0

zhangjungang/beats

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
克隆/下载
event.go 3.77 KB
一键复制 编辑 原始数据 按行查看 历史
package file
import (
"crypto/md5"
"crypto/sha1"
"crypto/sha256"
"crypto/sha512"
"encoding/hex"
"fmt"
"hash"
"io"
"os"
"runtime"
"strconv"
"time"
"github.com/pkg/errors"
"github.com/elastic/beats/libbeat/common"
)
// Action is a description of the change that occurred.
type Action uint8
func (a Action) String() string {
if name, found := actionNames[a]; found {
return name
}
return "unknown"
}
// List of possible Actions.
const (
Unknown Action = iota << 1
AttributesModified
Created
Deleted
Updated
Moved
)
var actionNames = map[Action]string{
AttributesModified: "attributes_modified",
Created: "created",
Deleted: "deleted",
Updated: "updated",
Moved: "moved",
}
// Event describe the filesystem change and includes metadata about the file.
type Event struct {
Timestamp time.Time // Time of event.
Path string // The path associated with the event.
TargetPath string // Target path for symlinks.
Action string // Action (like created, updated).
Info *Metadata // File metadata (if the file exists).
Hashes map[string]string // File hashes.
errors []error
}
// Metadata contains file metadata.
type Metadata struct {
Inode uint64
UID uint32
GID uint32
SID string
Owner string
Group string
Mode os.FileMode
Size int64
ATime time.Time // Last access time.
MTime time.Time // Last modification time.
CTime time.Time // Last status change time.
Type string // File type (dir, file, symlink).
}
func buildMapStr(e *Event) common.MapStr {
m := common.MapStr{
"@timestamp": e.Timestamp,
"path": e.Path,
"action": e.Action,
"hashed": len(e.Hashes) > 0,
}
if e.TargetPath != "" {
m["target_path"] = e.TargetPath
}
if e.Info != nil {
info := e.Info
m["inode"] = strconv.FormatUint(info.Inode, 10)
m["size"] = info.Size
m["atime"] = info.ATime
m["mtime"] = info.MTime
m["ctime"] = info.CTime
if info.Type != "" {
m["type"] = info.Type
}
if runtime.GOOS == "windows" {
if info.SID != "" {
m["sid"] = info.SID
}
} else {
m["uid"] = info.UID
m["gid"] = info.GID
m["mode"] = fmt.Sprintf("%#04o", uint32(info.Mode))
}
if info.Owner != "" {
m["owner"] = info.Owner
}
if info.Group != "" {
m["group"] = info.Group
}
}
for name, hash := range e.Hashes {
m[name] = hash
}
return m
}
func hashFile(name string, hashType ...string) (map[string]string, error) {
if len(hashType) == 0 {
return nil, nil
}
var hashes []hash.Hash
for _, name := range hashType {
switch name {
case "md5":
hashes = append(hashes, md5.New())
case "sha1":
hashes = append(hashes, sha1.New())
case "sha224":
hashes = append(hashes, sha256.New224())
case "sha256":
hashes = append(hashes, sha256.New())
case "sha384":
hashes = append(hashes, sha512.New384())
case "sha512":
hashes = append(hashes, sha512.New())
case "sha512_224":
hashes = append(hashes, sha512.New512_224())
case "sha512_256":
hashes = append(hashes, sha512.New512_256())
default:
return nil, errors.Errorf("unknown hash type '%v'", name)
}
}
f, err := os.Open(name)
if err != nil {
return nil, errors.Wrap(err, "failed to open file for hashing")
}
defer f.Close()
hashWriter := multiWriter(hashes)
if _, err := io.Copy(hashWriter, f); err != nil {
return nil, errors.Wrap(err, "failed to calculate file hashes")
}
nameToHash := make(map[string]string, len(hashes))
for i, h := range hashes {
nameToHash[hashType[i]] = hex.EncodeToString(h.Sum(nil))
}
return nameToHash, nil
}
func multiWriter(hash []hash.Hash) io.Writer {
writers := make([]io.Writer, 0, len(hash))
for _, h := range hash {
writers = append(writers, h)
}
return io.MultiWriter(writers...)
}
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/zhangjungang/beats.git
git@gitee.com:zhangjungang/beats.git
zhangjungang
beats
beats
v6.0.0

搜索帮助

0d507c66 1850385 C8b1a773 1850385