Skip to content

Commit 4c9603b

Browse files
authored
Merge pull request #32 from Kalsaria-C/master
Scripts for generating logs required in sprints/livelabs
2 parents 720cfd4 + 1b4c4f5 commit 4c9603b

10 files changed

+478
-0
lines changed

utils/api-logs-generator.py

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import random
2+
from datetime import datetime, timedelta
3+
4+
current_time = datetime.utcnow()
5+
method = ["POST", "GET"]
6+
username = ["livelabuser01", "Naman", "Jacob", "Riya", "livelabuser02"]
7+
client_ip = ["::ffff:10.244.0.104", "::ffff:10.244.0.257", "::ffff:10.244.0.158", "::ffff:10.244.0.007", "::ffff:10.244.0.257"]
8+
req_code = ["401", "200", "201", "304", "400", "404", "406", "409", "500", "503"]
9+
content_length = random.randint(10,1000)
10+
11+
for i in range(1000): # 1000 random logs generated
12+
random_var_user_and_ip = random.randint(0,len(username)-1)
13+
# Generate a random number of seconds between 0 and 7200 (120 minutes)
14+
random_seconds = random.randint(0, 120*60)
15+
# Calculate the end time by subtracting random seconds from current time
16+
end_time_in_seconds = current_time - timedelta(seconds=random_seconds)
17+
# Random 1000 log records of 2 hours before current UTC time.
18+
end_time_in_proper_format = end_time_in_seconds.strftime('%d/%b/%Y:%T')
19+
log = client_ip[random_var_user_and_ip] + " - " + username[random_var_user_and_ip] + " [" + end_time_in_proper_format + " +0000] " + '"' + method[random.randint(0,len(method)-1)] + " /api/orders HTTP/1.1" + '" ' + req_code[random.randint(0,len(req_code)-1)] + " " + str(content_length) + ' "-" ' + '"python-requests/2.25.1"' + "\n"
20+
with open('livelab_logs.txt', 'a') as f:
21+
f.write(log)
22+
f.close()
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
echo '
4+
{
5+
"name": "fluentd",
6+
"ready": true,
7+
"restartCount": 0,
8+
"image": "iad.ocir.io/namespace/fluentd_loganalytics_1:latest",
9+
"imageID": "docker-pullable://iad.ocir.io/ns/fluentd_loganalytics_1@sha256:123456712345677c2b71e6e632ea376466d80997067e78e522862a62d58922fa",
10+
"containerID": "docker://090458514f4d8ba69844f4cdcd55128d576ac6777e5937ca16f9e319fedb2536",
11+
"started": true,
12+
"initContainer": false,
13+
"state": {
14+
"status": "running",
15+
"startedAt": "2021-08-13T12:21:35Z"
16+
},
17+
"lastState": {},
18+
"podName": "fluentd-g42bx",
19+
"nodeName":"10.20.10.14",
20+
"namespaceName":"kube-system"
21+
}';
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
echo $(date +"%a %b %d %H:%M:%S %Y")"
4+
ERROR:
5+
ORA-12547 : TNS: lost contact
6+
7+
Cause: Partner has unexpectedly gone away, usually during process startup.
8+
9+
Action: Investigate partner application for abnormal termination. On an Interchange, this can happen if the machine is overloaded.
10+
";
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
echo -n $(date +"%a %b"); echo -n " "; echo $(date +"%d %H:%M:%S %Y %z")"
4+
LENGTH : '157'
5+
ACTION :[67] 'ALTER PROFILE'
6+
DATABASE USER:[3] 'sys'
7+
PRIVILEGE :[6] 'SYSDBA'
8+
CLIENT USER:[8] 'user1'
9+
CLIENT TERMINAL:[0] ''
10+
STATUS:[1] '0'
11+
DBID:[9] '592398530'
12+
";
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
3+
# Picks the username sent as an argument to made the logs with or picks the current user
4+
USER_NAME=${1:-$(whoami)}
5+
6+
# A sample of Ip Addresses from multiple locations to trigger the alarm
7+
SAMPLE_IP_ADDRESSES=( "22.60.240.244" "196.220.230.205" "40.39.48.34" "217.128.212.236" "17.241.30.58" )
8+
9+
# Generates the logs file content made of 5 unsuccesful login attempts OCI audit logs
10+
for IP_ADDRESS in ${SAMPLE_IP_ADDRESSES[@]};
11+
do
12+
13+
# Generates the json content of the log
14+
echo -n "
15+
{
16+
\"data\": {
17+
\"availabilityDomain\": \"AD1\",
18+
\"compartmentId\": \"ocid1.tenancy.uniqueId\",
19+
\"compartmentName\": \"tanancy-uuid\",
20+
\"eventName\": \"InteractiveLogin\",
21+
\"identity\": {
22+
\"ipAddress\": \"$IP_ADDRESS\",
23+
\"principalId\": \"ocid1.user.oc1.uniqueId\",
24+
\"principalName\": \"$USER_NAME\",
25+
\"tenantId\": \"ocid1.tenancy.uniqueId\",
26+
\"userAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0\"
27+
},
28+
\"message\": \"InteractiveLogin failed\",
29+
\"response\": {
30+
\"payload\": {
31+
\"login_input\": \"tenant: tanancy-uuid, user: $USER_NAME\",
32+
\"login_result\": \"PASSWORD_INVALID\"
33+
},
34+
\"responseTime\": \"2023-11-13T10:25:30.589Z\",
35+
\"status\": \"400\"
36+
}
37+
},
38+
\"time\": \"$(date +"%Y-%m-%dT%H:%M:%S%:%z")\",
39+
\"type\": \"com.oraclecloud.IdentitySignOn.InteractiveLogin\"
40+
}";
41+
done;
42+
43+
# Substitutes any trailing character by a new line
44+
echo;

utils/f5-firewall-logs.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import os
2+
import random
3+
from datetime import datetime, timedelta
4+
5+
current_time = datetime.utcnow()
6+
formatted_time = current_time.strftime("%b %d %H:%M:%S")
7+
log_message = fr"{formatted_time} XXXX_F5_DMZXX err dcc[11457]: 9999999999:9: [SECEV] Request blocked, violations: Web scraping detected. HTTP protocol compliance sub violations: N/A. Evasion techniques sub violations: N/A. Web services security sub violations: N/A. Virus name: N/A. Support id: 99999999999999999, source ip: 192.168.1.100, xff ip: N/A, source port: 99999, destination ip: 203.128.45.67, destination port: 999, route_domain: 200, HTTP classifier: /Common/www.xxxxxxxxx.yy.http, scheme HTTPS, geographic location: <RU>, request: <GET /ns/xxxxxx.yyy?id_seccion=9999 HTTP/1.1\r\nContent-Length: 0\r\nCookie: XXXXXXXX_XXXXXXXXX=d8b78f937f6f9d569cda500fd5cae49>, username: <[email protected]>, session_id: <d9ba5ea0f4e98df0>"
8+
9+
file_name = 'f5-firewall-logs.log'
10+
if os.path.exists(file_name):
11+
os.remove(file_name)
12+
13+
with open(file_name, 'a') as f:
14+
f.write(log_message)
15+
f.close()

utils/microsoft-dns-server-logs.py

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
import os
2+
import random
3+
from datetime import datetime, timedelta
4+
5+
current_time = datetime.utcnow() - timedelta(minutes=10)
6+
formatted_time = current_time.strftime("%m/%d/%Y %I:%M:%S %p")
7+
event_str = f"{formatted_time} 03B4 EVENT 192.168.1.10 The DNS server has started."
8+
ips = ['10.0.0.5', '192.168.2.20', '192.168.2.2', '10.1.1.1']
9+
sockets = [336, 336, 328, 2688]
10+
remote_addrs = ['::1', '::1', '192.168.1.2', '192.168.1.2']
11+
ports = [64329, 64329, 37325, 53]
12+
packet_str = ''
13+
14+
def choice_and_remove(list):
15+
random_element = random.choice(list)
16+
list.remove(random_element)
17+
return random_element
18+
19+
def get_random_values():
20+
return {
21+
'ip': choice_and_remove(ips),
22+
'socket': choice_and_remove(sockets),
23+
'remote_addr': choice_and_remove(remote_addrs),
24+
'port': choice_and_remove(ports)
25+
}
26+
27+
for i in range(4):
28+
current_time += timedelta(seconds=random.randint(1, 120))
29+
formatted_time = current_time.strftime("%m/%d/%Y %I:%M:%S %p")
30+
random_values = get_random_values()
31+
packet_str += f'''\n{formatted_time} 00DC PACKET {random_values['ip']} 00000000016B80A0 UDP Rcv ::1 9ebb Q [0001 D NOERROR] SOA (5)xyztu(4)labs(0)
32+
UDP question info at 00000000016B80A0
33+
Socket = {random_values['socket']}
34+
Remote addr {random_values['remote_addr']}, port {random_values['port']}
35+
Time Query=588068, Queued=0, Expire=0
36+
Buf length = 0x0fa0 (4000)
37+
Msg length = 0x001c (28)
38+
Message:
39+
XID 0x9ebb
40+
Flags 0x0100
41+
QR 0 (QUESTION)
42+
OPCODE 0 (QUERY)
43+
AA 0
44+
TC 0
45+
RD 1
46+
RA 0
47+
Z 0
48+
CD 0
49+
AD 0
50+
RCODE 0 (NOERROR)
51+
QCOUNT 1
52+
ACOUNT 0
53+
NSCOUNT 0
54+
ARCOUNT 0
55+
QUESTION SECTION:
56+
Offset = 0x000c, RR count = 0
57+
Name "(5)xyztu(4)labs(0)"
58+
QTYPE SOA (6)
59+
QCLASS 1
60+
ANSWER SECTION:
61+
empty
62+
AUTHORITY SECTION:
63+
empty
64+
ADDITIONAL SECTION:
65+
empty'''
66+
67+
logs = f'{event_str}{packet_str}'
68+
file_name = 'microsoft-dns-server-logs.log'
69+
70+
if os.path.exists(file_name):
71+
os.remove(file_name)
72+
73+
with open(file_name, 'a') as f:
74+
f.write(logs)
75+
f.close()

utils/oci-storage-bucket-logs.py

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
import os
2+
import random
3+
from datetime import datetime, timedelta
4+
5+
ingested_time = datetime.utcnow() - timedelta(minutes=3)
6+
time = ingested_time + timedelta(seconds=random.randint(1, 120))
7+
formatted_ingested_time = ingested_time.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
8+
formatted_time = time.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
9+
10+
log_string = f'''
11+
{{
12+
"data": {{
13+
"apiType": "native",
14+
"authenticationType": "instance",
15+
"bucketCreator": "Unknown",
16+
"bucketId": "ocid1.bucket.oc1.abc.abcdef123456789",
17+
"bucketName": "log",
18+
"clientIpAddress": "192.168.0.104",
19+
"compartmentId": "ocid1.compartment.oc1..abcdefg1234568888",
20+
"compartmentName": "compartment_name",
21+
"credentials": "abcdef123456789abcdef",
22+
"eTag": "45385429-904b-4db1-866e-123",
23+
"endTime": "2020-09-29T20:02:31.811Z",
24+
"isPar": false,
25+
"message": "Object retrieved.",
26+
"namespaceName": "namespace_value",
27+
"objectName": "object_name",
28+
"opcRequestId": "iad-1:x-uGtXG5Wdk3abc",
29+
"principalId": "ocid1.instance.oc1.12345",
30+
"principalName": "UnknownPrincipal",
31+
"region": "us-region-2",
32+
"requestAction": "GET",
33+
"requestResourcePath": "/n/namespace_value/b/log/o/object_name",
34+
"startTime": "2023-09-29T20:02:31.787Z",
35+
"statusCode": 200,
36+
"tenantId": "ocid1.tenancy.oc1..6w4ohcbz7otxxy6kd",
37+
"tenantName": "loganprod",
38+
"userAgent": "Oracle-JavaSDK/1.19.3 (Linux/4.14.35-1902.305.4.el7uek.x86_64; Java/1.8.0_251; Java HotSpot(TM) 64-Bit GraalVM EE 19.3.2/25.251-b08-jvmci-20.1-b02-dev)",
39+
"vcnId": "477016"
40+
}},
41+
"id": "20919d7c-2d6d-401a-9858-123",
42+
"oracle": {{
43+
"compartmentid": "ocid1.compartment.oc1..lxenat5opur",
44+
"ingestedtime": "{formatted_ingested_time}",
45+
"loggroupid": "ocid1.loggroup.oc1.gmsmd5c7qmebnsyx7dm",
46+
"logid": "ocid1.log.oc1.iz6lu3innhmdyb6aiamaaaaa",
47+
"tenantid": "ocid1.tenancy.oc1..1234"
48+
}},
49+
"source": "log",
50+
"specversion": "1.0",
51+
"subject": "subject value",
52+
"time": "{formatted_time}",
53+
"type": "com.oraclecloud.objectstorage.getobject"
54+
}}
55+
'''
56+
57+
file_name = 'oci-storage-bucket-logs.log'
58+
59+
if os.path.exists(file_name):
60+
os.remove(file_name)
61+
62+
with open(file_name, 'a') as f:
63+
f.write(log_string)
64+
f.close()

utils/upload-helper.py

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
"""
2+
# This script is intended to run in your OCI Tenancy,
3+
# It uploads a file from your OCI Shell into the logging analytics upload service.
4+
5+
# @param file - the path of the file to upload
6+
# @param filename - The name with which the file will be saved in OCI
7+
# @param log-source - The log source to upload the file for
8+
# @param name - The name of the upload instance
9+
"""
10+
import subprocess, json, argparse
11+
12+
13+
# CLI Arguments
14+
argParser = argparse.ArgumentParser()
15+
argParser.add_argument("-f", "--file", help="your file", required=True)
16+
argParser.add_argument("-s", "--filename", help="your filename", required=True)
17+
argParser.add_argument("-l", "--log-source", help="your log source", required=True)
18+
argParser.add_argument("-n", "--name", help="your name", required=True)
19+
20+
args = argParser.parse_args()
21+
22+
23+
# Functions
24+
# Lets the user choose a compartment to use the groups of
25+
def choose_compartment() -> str:
26+
27+
# Compartment Variables
28+
compartments = json.loads(
29+
subprocess.getoutput('oci iam compartment list --all --query "data[].{name:name, id:id}" --access-level ANY --compartment-id-in-subtree true')
30+
)
31+
compartments_names = [compartment['name'] for compartment in compartments]
32+
33+
# List the compartments of the OCI tenancies
34+
print("Here is the list of your OCI tenancy compartments: ")
35+
for name in enumerate(compartments_names):
36+
print(*name, sep='> ')
37+
38+
# Prompt the user to select a value
39+
selected_input = input("Please, Choose the index of the compartment you want to upload your files to: ")
40+
41+
while not (selected_input.isnumeric() and 0 <= int(selected_input) < len(compartments_names)) : # re-prompt if the user selected a different value
42+
selected_input = input("The compartment selected does not exist, Please choose a valid compartment index: ")
43+
44+
return compartments[int(selected_input)]
45+
46+
47+
# Get the default namespace label
48+
def get_namespace() -> str:
49+
namespace = subprocess.getoutput('''oci log-analytics namespace list --compartment-id $(oci iam compartment list --all --compartment-id-in-subtree true --access-level ACCESSIBLE --include-root --raw-output --query "data[?contains(\\"id\\",'tenancy')].id | [0]") --query "data.items[].{namespace: \\"namespace-name\\"}[0].namespace" --raw-output''')
50+
51+
return namespace
52+
53+
54+
# Lets the user choose a compartment to use the groups of
55+
def choose_log_group(settings:dict) -> str:
56+
57+
response = subprocess.getoutput(f'''oci log-analytics log-group list -c {settings["compartment"]["id"]} --namespace-name {settings["namespace"]} --query "data.items[].{{name: \\"display-name\\", id: id}}"''')
58+
59+
if response == "Query returned empty result, no output to show.":
60+
# Create a new log group
61+
print('You have no log groups in your compartment (Check your region and tenancy again)')
62+
if not input('Do you want to create a new log group automatically? (y|n): ').lower() in ('y', 'yes'):
63+
return
64+
65+
return create_log_group(settings)
66+
67+
# Compartment Variables
68+
log_groups = json.loads(
69+
subprocess.getoutput(f'''oci log-analytics log-group list -c {settings["compartment"]["id"]} --namespace-name {settings["namespace"]} --query "data.items[].{{name: \\"display-name\\", id: id}}"''')
70+
)
71+
72+
log_groups_names = [log_group['name'] for log_group in log_groups]
73+
74+
# List the log groups of the OCI tenancies
75+
print("Here is the list of your OCI tenancy log groups: ")
76+
for name in enumerate(log_groups_names):
77+
print(*name, sep='> ')
78+
79+
# Prompt the user to select a value
80+
selected_input = input("Please, Choose the index of the log group you want to upload your files to: ")
81+
82+
while not (selected_input.isnumeric() and 0 <= int(selected_input) < len(log_groups_names)) : # re-prompt if the user selected a different value
83+
selected_input = input("The log group selected does not exist, Please choose a valid log group index: ")
84+
85+
return log_groups[int(selected_input)]
86+
87+
88+
# Create a new log group
89+
def create_log_group(settings:dict):
90+
return json.loads(
91+
subprocess.getoutput(f"""oci log-analytics log-group create --namespace-name {settings["namespace"]} --display-name "Live Labs Log Group - You can delete it once you are done" --compartment-id {settings["compartment"]["id"]}""")
92+
)
93+
94+
95+
# Implementation
96+
# The bash command parameters
97+
settings = {
98+
"compartment": choose_compartment(),
99+
"namespace": get_namespace()
100+
}
101+
102+
settings["log_group"] = choose_log_group(settings)
103+
104+
# OCI command script
105+
print(
106+
subprocess.getoutput(f'''oci log-analytics upload upload-log-file --file "{args.file}" --filename "{args.filename}" --log-source-name "{args.log_source}" --namespace-name "{settings["namespace"]}" --opc-meta-loggrpid "{settings["log_group"]["id"]}" --upload-name "{args.name}"''')
107+
)

0 commit comments

Comments
 (0)