sw-collector: Iterate through history logs

The logrotate function causes the apt history to be split into
several parts at arbitrary points in time. If history.log only
is parsed then some package installation changes stored in
zipped backup history files might get lost.

Thus sw-collector now searches all backup history files until
a date older than the current event stored in the collector.db
database is found, so that no entries get overlooked.
This commit is contained in:
Andreas Steffen
2021-12-31 14:33:22 +01:00
parent 0b76ca13ab
commit 903c68e069
4 changed files with 142 additions and 56 deletions
@@ -17,8 +17,8 @@ alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
alice::cat /var/log/daemon.log::SASL client identity is.*carol::YES
alice::cat /var/log/daemon.log::user AR identity.*carol.*authenticated by password::YES
alice::cat /var/log/daemon.log::received software ID events with ... items for request 9 at last eid 2 of epoch::YES
alice::cat /var/log/daemon.log::received software ID events with ... items for request 9 at last eid 3 of epoch::YES
alice::cat /var/log/daemon.log::3 SWID tag target::YES
alice::cat /var/log/daemon.log::received software inventory with 3 items for request 9 at last eid 2 of epoch::YES
alice::cat /var/log/daemon.log::received software inventory with 3 items for request 9 at last eid 3 of epoch::YES
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
@@ -23,17 +23,17 @@ INSERT INTO sw_identifiers (
INSERT INTO sw_events (
eid, sw_id, action
) VALUES (
2, 1, 2
3, 1, 2
);
INSERT INTO sw_events (
eid, sw_id, action
) VALUES (
2, 2, 2
3, 2, 2
);
INSERT INTO sw_events (
eid, sw_id, action
) VALUES (
2, 3, 2
3, 3, 2
);