|
| 1 | +# -*- coding: utf-8 -*- |
| 2 | +"""Text file parser plugin for Container Runtime Interface (CRI) log format. |
| 3 | +
|
| 4 | +This is a text-based log format used in kubernetes/GKE. |
| 5 | +
|
| 6 | +Also see: |
| 7 | + https://github.com/kubernetes/design-proposals-archive/blob/main/node/kubelet-cri-logging.md |
| 8 | +""" |
| 9 | + |
| 10 | +import pyparsing |
| 11 | + |
| 12 | +from dfdatetime import time_elements |
| 13 | + |
| 14 | +from plaso.containers import events |
| 15 | +from plaso.lib import errors |
| 16 | +from plaso.parsers import text_parser |
| 17 | +from plaso.parsers.text_plugins import interface |
| 18 | + |
| 19 | + |
| 20 | +class CRIEventData(events.EventData): |
| 21 | + """CRI log event data. |
| 22 | +
|
| 23 | + Attributes: |
| 24 | + body (str): the log message body. |
| 25 | + event_datetime (time_elements.TimeElementsInNanoseconds): the datetime of |
| 26 | + the log message. |
| 27 | + stream (str): the log stream. Currently only 'stdout' and 'stderr' are |
| 28 | + supported. |
| 29 | + tag (str): the log tag. Currently only 'P' (partial) and 'F' (full) are |
| 30 | + supported. |
| 31 | + """ |
| 32 | + DATA_TYPE = 'cri:container:log:entry' |
| 33 | + |
| 34 | + def __init__(self): |
| 35 | + """Initializes event data.""" |
| 36 | + super(CRIEventData, self).__init__(data_type=self.DATA_TYPE) |
| 37 | + self.body = None |
| 38 | + self.event_datetime = None |
| 39 | + self.stream = None |
| 40 | + self.tag = None |
| 41 | + |
| 42 | + |
| 43 | +class CRITextPlugin(interface.TextPlugin): |
| 44 | + """Text file parser plugin for CRI log files.""" |
| 45 | + |
| 46 | + NAME = 'cri_log' |
| 47 | + DATA_FORMAT = 'Container Runtime Interface log file' |
| 48 | + |
| 49 | + ENCODING = 'utf-8' |
| 50 | + |
| 51 | + # Date and time values are formatted as: 2016-10-06T00:17:09.669794202Z |
| 52 | + _DATE_AND_TIME = ( |
| 53 | + pyparsing.Regex(r'\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{1,9}Z') |
| 54 | + ).setResultsName('date_time') |
| 55 | + |
| 56 | + _STREAM = ( |
| 57 | + pyparsing.Literal('stderr') ^ pyparsing.Literal('stdout') |
| 58 | + ).setResultsName('stream') |
| 59 | + |
| 60 | + # P indicates a partial log, |
| 61 | + # F indicates a complete or the end of a multiline log. |
| 62 | + _TAG = pyparsing.oneOf(['P', 'F']).setResultsName('tag') |
| 63 | + |
| 64 | + _LOG = ( |
| 65 | + pyparsing.restOfLine() + pyparsing.Suppress(pyparsing.LineEnd()) |
| 66 | + ).setResultsName('body') |
| 67 | + |
| 68 | + _LOG_LINE = _DATE_AND_TIME + _STREAM + _TAG + _LOG |
| 69 | + _LINE_STRUCTURES = [('log_line', _LOG_LINE)] |
| 70 | + |
| 71 | + VERIFICATION_GRAMMAR = _LOG_LINE |
| 72 | + |
| 73 | + def _ParseRecord(self, parser_mediator, key, structure): |
| 74 | + """Parses a pyparsing structure. |
| 75 | +
|
| 76 | + Args: |
| 77 | + parser_mediator (ParserMediator): mediates interactions between parsers |
| 78 | + and other components, such as storage and dfVFS. |
| 79 | + key (str): name of the parsed structure. |
| 80 | + structure (pyparsing.ParseResults): tokens from a parsed log line. |
| 81 | +
|
| 82 | + Raises: |
| 83 | + ParseError: if the structure cannot be parsed. |
| 84 | + """ |
| 85 | + if key == 'log_line': |
| 86 | + date_time = time_elements.TimeElementsInNanoseconds() |
| 87 | + date_time.CopyFromStringISO8601(self._GetValueFromStructure( |
| 88 | + structure, 'date_time')) |
| 89 | + event_data = CRIEventData() |
| 90 | + event_data.event_datetime = date_time |
| 91 | + event_data.body = self._GetValueFromStructure( |
| 92 | + structure, 'body')[0] |
| 93 | + event_data.stream = self._GetValueFromStructure(structure, 'stream') |
| 94 | + event_data.tag = self._GetValueFromStructure(structure, 'tag') |
| 95 | + parser_mediator.ProduceEventData(event_data) |
| 96 | + |
| 97 | + def CheckRequiredFormat(self, parser_mediator, text_reader): |
| 98 | + """Check if the log record has the minimal structure required by the parser. |
| 99 | +
|
| 100 | + Args: |
| 101 | + parser_mediator (ParserMediator): mediates interactions between parsers |
| 102 | + and other components, such as storage and dfVFS. |
| 103 | + text_reader (EncodedTextReader): text reader. |
| 104 | +
|
| 105 | + Returns: |
| 106 | + bool: True if this is the correct parser, False otherwise. |
| 107 | + """ |
| 108 | + try: |
| 109 | + self._VerifyString(text_reader.lines) |
| 110 | + except errors.ParseError: |
| 111 | + return False |
| 112 | + |
| 113 | + return True |
| 114 | + |
| 115 | + |
| 116 | +text_parser.TextLogParser.RegisterPlugin(CRITextPlugin) |
0 commit comments