Skip to content

Commit

Permalink
feat(#3562): add generic fim event checker
Browse files Browse the repository at this point in the history
  • Loading branch information
Deblintrake09 committed Jan 3, 2023
1 parent ea4bf0c commit 8144336
Showing 1 changed file with 25 additions and 3 deletions.
28 changes: 25 additions & 3 deletions deps/wazuh_testing/wazuh_testing/modules/fim/event_monitor.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,15 @@
import json

from datetime import datetime
from wazuh_testing import logger
from wazuh_testing.tools.monitoring import generate_monitoring_callback
from wazuh_testing import logger, T_60, LOG_FILE_PATH
from wazuh_testing.tools.monitoring import FileMonitor, generate_monitoring_callback
from wazuh_testing.modules import fim

# Callback Messages
CB_FIM_PATH_CONVERTED = r".*fim_adjust_path.*Convert '(.*) to '(.*)' to process the FIM events."

# Callbacks

# Callback functions
def callback_detect_event(line):
"""
Detect an 'event' type FIM log.
Expand Down Expand Up @@ -141,6 +143,26 @@ def callback_detect_file_deleted_event(line):


# Event checkers
def check_fim_event(file_monitor=None, callback='', error_message=None, update_position=True,
timeout=T_60, accum_results=1, file_to_monitor=LOG_FILE_PATH):
"""Check if a analysisd event occurs
Args:
file_monitor (FileMonitor): FileMonitor object to monitor the file content.
callback (str): log regex to check in Wazuh log
error_message (str): error message to show in case of expected event does not occur
update_position (boolean): filter configuration parameter to search in Wazuh log
timeout (str): timeout to check the event in Wazuh log
accum_results (int): Accumulation of matches.
"""
file_monitor = FileMonitor(file_to_monitor) if file_monitor is None else file_monitor
error_message = f"Could not find this event in {file_to_monitor}: {callback}" if error_message is None else \
error_message

file_monitor.start(timeout=timeout, update_position=update_position, accum_results=accum_results,
callback=generate_monitoring_callback(callback), error_message=error_message)


def detect_initial_scan(file_monitor):
"""Detect initial scan when restarting Wazuh.
Expand Down

0 comments on commit 8144336

Please sign in to comment.