#!/usr/bin/perl
#
#  Copyright (c) 2004, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
#  All rights reserved.
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are met:
#
#   * Redistributions of source code must retain the above copyright notice,
#     this list of conditions and the following disclaimer.
#   * Redistributions in binary form must reproduce the above copyright notice,
#     this list of conditions and the following disclaimer in the documentation
#     and/or other materials provided with the distribution.
#   * Neither the name of SWITCH nor the names of its contributors may be
#     used to endorse or promote products derived from this software without
#     specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
#  POSSIBILITY OF SUCH DAMAGE.
#
#  $Author: peter $
#
#  $Id: demoplugin.pm 27 2005-04-20 13:50:06Z peter $
#
#  $LastChangedRevision: 27 $

# Demo plugin for NfSen
#
# This plugin demonstrates the use of plugins
#	It searches for flows > 500000 packets and sends the output
#	using the Notification module

package demoplugin;

use strict;
use NfSen;
use NfConf;

#
# The plugin may send any messages to syslog
# Do not initialize syslog, as this is done by 
# the main process nfsen-run
use Sys::Syslog;
Sys::Syslog::setlogsock('unix');
  
# Use the optional Notification module
use Notification;

my ( $nfdump, $PROFILEDIR );

#
# Define a nice filter: 
# We like to see flows containing more than 500000 packets
my $nf_filter = 'packets > 500000';

#
# Periodic function
#	input:	profilename
#			timeslot. Format yyyymmddHHMM e.g. 200503031200
sub run {
	my $profile  = shift;
	my $timeslot = shift;

	syslog('debug', "demoplugin run: Profile: $profile, Time: $timeslot");

	my %profileinfo     = NfSen::ReadProfile($profile);
	my $netflow_sources = "$PROFILEDIR/$profile/$profileinfo{'sourcelist'}";

	# 
	# process all sources of this profile at once
	my @output = `$nfdump -M $netflow_sources -r nfcapd.$timeslot '$nf_filter'`;
	
	#
	# Process the output and notify the duty team

	# The 2nd but last line contains the stat info of the processed flow:
	# e.g. Flows analysed: 61 matched: 61, Bytes read: 3168
	if ( $output[-2] =~ /matched:\s+(\d+)/ ) {
		my $matched = $1;
		syslog('debug', "demoplugin run: $matched flows");
		if ( $matched ) {
			notify("Packets > 500000: Profile $profile, Timeslot $timeslot", \@output );
		}
	} else {
		syslog('err', "Unparsable output line '$output[-2]'");
	}


	# .... more to come
	
}

sub Init {
	syslog("info", "demoplugin: Init");

	# Init some vars
	$nfdump  = "$NfConf::PREFIX/nfdump";
	$PROFILEDIR = "$NfConf::PROFILEDIR";

	return 1;
}

sub BEGIN {
	syslog("info", "demoplugin BEGIN");
	# Standard BEGIN Perl function - See Perl documentation
	# not used here
}

sub END {
	syslog("info", "demoplugin END");
	# Standard END Perl function - See Perl documentation
	# not used here
}

1;
