import re ################################################################################# # REGULAR EXPRESSIONS ARE COOL. Check out Kodos (http://kodos.sourceforge.net) # ################################################################################# #DATE_FORMAT_REGEX = re.compile(r"""(?P[A-z]{3,3})\s*(?P\d+)""") #SSHD_FORMAT_REGEX = re.compile(r""".* (sshd.*:|\[sshd\]) (?P.*)""") SSHD_FORMAT_REGEX = re.compile(r""".* (sshd.*:|\[sshd\]|ftpd.*|\[ftpd\]) (?P.*)""") FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P.*) for (?Pinvalid user |illegal user )?(?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") FAILED_ENTRY_REGEX2 = re.compile(r"""(Illegal|Invalid) user (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") FAILED_ENTRY_REGEX3 = re.compile(r"""Authentication failure for (?P.*) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") #FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P.*) from (?P.*)""") FAILED_ENTRY_REGEX4 = re.compile(r"""FTP LOGIN FAILED FROM (?P), (?P.*)""") SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P.*) for (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") TIME_SPEC_REGEX = re.compile(r"""(?P\d*)\s*(?P[smhdwy])?""") ALLOWED_REGEX = re.compile(r"""(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.)((?P\d{1,3})|(?P\*)|\[(?P\d{1,3}\-\d{1,3})\])""") PREFS_REGEX = re.compile(r"""(?P.*?)\s*[:=]\s*(?P.*)""")