Initial commit: LogMaster with Viewer Collector Monitor modes

2026-05-04 13:50:15 +02:00
commit 44cd9ab001
231 changed files with 29018 additions and 0 deletions
--- a/setup-monitor-test.js
+++ b/setup-monitor-test.js
@@ -0,0 +1,118 @@
+// Setup a monitor rule and trigger it to test
+const http = require('http');
+
+const MONITOR_URL = 'http://localhost:8082';
+
+function post(path, data) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(data);
+    const url = new URL(path, MONITOR_URL);
+    const req = http.request({
+      hostname: url.hostname, port: url.port, path: url.pathname,
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let body = '';
+      res.on('data', c => body += c);
+      res.on('end', () => { try { resolve(JSON.parse(body)); } catch { resolve(body); } });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+function get(path) {
+  return new Promise((resolve, reject) => {
+    http.get(MONITOR_URL + path, (res) => {
+      let body = '';
+      res.on('data', c => body += c);
+      res.on('end', () => { try { resolve(JSON.parse(body)); } catch { resolve(body); } });
+    }).on('error', reject);
+  });
+}
+
+async function main() {
+  console.log('\n  === Monitor Test Setup ===\n');
+
+  // 1. Create rule
+  console.log('  1. Creating rule "Root DB Access Detection"...');
+  const rule = await post('/api/monitor/rules', {
+    id: 'root-access',
+    name: 'Root DB Access Detection',
+    enabled: true,
+    sources: ['sample-logs/security-audit.log'],
+    patterns: ['root.*login', 'root.*executed', 'GRANT.*PRIVILEGES', 'DROP TABLE'],
+    patternLogic: 'any',
+    timeRange: { type: 'all' },
+    notifications: [{ type: 'webhook', url: 'http://localhost:8082/api/monitor/results' }],
+    maxLinesInMessage: 20,
+    cooldownMs: 10000,
+    matchCount: 0,
+    lastTriggered: null,
+    schedule: { mode: 'interval' },
+  });
+  console.log('     Result:', rule.ok ? 'OK' : 'FAILED');
+
+  // 2. Create second rule
+  console.log('  2. Creating rule "Failed Login Attempts"...');
+  const rule2 = await post('/api/monitor/rules', {
+    id: 'failed-logins',
+    name: 'Failed Login Attempts',
+    enabled: true,
+    sources: ['sample-logs/security-audit.log'],
+    patterns: ['Failed login', 'Account locked'],
+    patternLogic: 'any',
+    timeRange: { type: 'all' },
+    notifications: [{ type: 'webhook', url: 'http://localhost:8082/api/monitor/results' }],
+    maxLinesInMessage: 10,
+    cooldownMs: 10000,
+    matchCount: 0,
+    lastTriggered: null,
+    schedule: { mode: 'interval' },
+  });
+  console.log('     Result:', rule2.ok ? 'OK' : 'FAILED');
+
+  // 3. List rules
+  console.log('\n  3. Current rules:');
+  const rules = await get('/api/monitor/rules');
+  for (const r of rules) {
+    console.log(`     - ${r.name} (${r.patterns.length} patterns, enabled: ${r.enabled})`);
+  }
+
+  // 4. Trigger the first rule manually
+  console.log('\n  4. Triggering "Root DB Access Detection" manually...');
+  const result = await post('/api/monitor/trigger/root-access', {});
+  if (result && result.totalMatches) {
+    console.log(`     ✅ Found ${result.totalMatches} matches!`);
+    console.log('     Sample matches:');
+    for (const line of result.matchedLines.slice(0, 5)) {
+      console.log(`       | ${line}`);
+    }
+    if (result.totalMatches > 5) {
+      console.log(`       ... and ${result.totalMatches - 5} more`);
+    }
+  } else {
+    console.log('     No matches found.');
+  }
+
+  // 5. Trigger second rule
+  console.log('\n  5. Triggering "Failed Login Attempts"...');
+  const result2 = await post('/api/monitor/trigger/failed-logins', {});
+  if (result2 && result2.totalMatches) {
+    console.log(`     ✅ Found ${result2.totalMatches} matches!`);
+    for (const line of result2.matchedLines.slice(0, 3)) {
+      console.log(`       | ${line}`);
+    }
+  }
+
+  // 6. Check results
+  console.log('\n  6. Alert history:');
+  const results = await get('/api/monitor/results');
+  for (const r of results) {
+    console.log(`     - [${r.timestamp}] ${r.ruleName}: ${r.totalMatches} matches`);
+  }
+
+  console.log('\n  === Done! Open http://localhost:8082 to see the GUI ===\n');
+}
+
+main().catch(e => console.error('Error:', e.message));