Security event logging

#!/usr/bin/env python3

import select
from systemd import journal

def matches_template(message, template):
    """Checking for placeholders"""
    if '<' not in template or '>' not in template:
        # No placeholder — simple substring
        return template in message

    # Break the template into parts by <...>
    parts = []
    start = 0
    while True:
        i = template.find('<', start)
        if i == -1:
            # Balance after the last >
            parts.append(template[start:])
            break
        parts.append(template[start:i])
        j = template.find('>', i)
        if j == -1:
            # Unclosed < — consider everything to the end as text
            parts.append(template[i:])
            break
        start = j + 1

    # Remove empty parts (for example, if the template starts with <...>)
    parts = [p for p in parts if p]

    if not parts:
        return True  # empty template — always matches

    # Check that all parts go into the message in the correct order.
    pos = 0
    for part in parts:
        idx = message.find(part, pos)
        if idx == -1:
            return False
        pos = idx + len(part)
    return True

j = journal.Reader()
j.log_level(journal.LOG_INFO)

j.seek_tail()
j.get_previous()

p = select.poll()
p.register(j, j.get_events())

filters = {
    # Logging into the platform
    'login': {
        # proxy_message — query type. For example, /public/token at authorization
        'proxy': "Begin processing request target: '/public/token'",
        # auth_message — login and password authorization. Contains the user's ID or email address
        'auth': "SELECT auth_user.id AS `id`,auth_user.password AS `password`",
        # input_message — IP address and operation result: 
        # 200 — successful authorization;
        # 400 — authorization denied.
        'input': "POST /auth/v4/public/token"
    },
    # Logging out of the platform
    'logout': {
        # proxy_message1 — request type (DELETE/target/%2Ftoken — logout)
        'proxy1': "Begin processing request target: '/public/global/whoami/method/DELETE/target/%2Ftoken",
        # proxy_message2 — account information
        'proxy2': "Auth response body",
        # auth_message — deleting the authorization token
        'auth': "DELETE FROM auth_token WHERE auth_token.id",
        # input_message — operation result
        'input': "DELETE /auth/v4/token"
    },
    # Creating an account
    'user_create': {
        # writer_message1 — request type (POST /user — creating an account)
        'writer1': "request method: POST url: /user",
        # writer_message2 — internal-auth header, contains data about the account of the user who sent the request, in base64 format
        'writer2': "Got header: [internal-auth]",
        # writer_message3 — The IP address from which the request was sent
        'writer3': "Got header: [x-forwarded-for]",
        # writer_message4 — request content (name of the created account and its role)
        'writer4': "RequestBody",
        # writer_message5 — ID of the created account
        'writer5': "User <username> created in auth"
    },
    # Deleting an account
    'user_delete': {
        # writer_message1 — request type (DELETE /user/<ID> — deleting an account)
        'writer1': "request method: DELETE url: /user/<ID>",
        # writer_message2 — internal-auth header, contains data about the account of the user who sent the request, in base64 format
        'writer2': "Got header: [internal-auth]",
        # writer_message3 — The IP address from which the request was sent
        'writer3': "Got header: [x-forwarded-for]",
        # auth_message — ID of the deleted account
        'auth': "DELETE FROM auth_user WHERE auth_user.id"
    },
    # Changing the role of an account
    'user_role_change': {
        # writer_message1 — query type (POST /user/<ID> — editing an account)
        'writer1': "request method: POST url: /user/<ID>",
        # writer_message2 — internal-auth header, contains data about the account of the user who sent the request, in base64 format
        'writer2': "Got header: [internal-auth]",
        # writer_message3 — The IP address from which the request was sent
        'writer3': "Got header: [x-forwarded-for]",
        # auth_message — ID of the edited account and the assigned role.
        'auth': "UPDATE auth_user SET `roles`"
    },
    # Creating a key for key-based authorization
    'auth_key_create': {
        # proxy_message1 — query type (POST /user/<ID_or_email>/key — creating a key)
        'proxy1': "Begin processing request target: '/user/<ID_or_email>/key'",
        # proxy_message2 — information about the account from which the request originated
        'proxy2': "Auth response body",
        # auth_message — information about the created key
        'auth': "INSERT INTO auth_key",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/user/<ID_or_email>/key",
        'input2': "POST /api/auth/v4/user/<ID_or_email>/key"
    },
    # Key-based authorization
    'auth_by_key': {
        # proxy_message — query type (/public/key —  key-based authorization)
        'proxy': "Begin processing request target: '/public/key'",
        # auth_message — information about the created authorization token
        'auth': "INSERT INTO auth_token",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/public/key",
        'input2': "POST /api/auth/v4/public/key"
    },
    # Resetting an account password
    'password_reset': {
        # proxy_message1 — query type (POST /user/<ID>/password — password reset)
        'proxy1': "Begin processing request target: '/user/<ID>/password'",
        # proxy_message2 — information about the account that requested the reset
        'proxy2': "Auth response body",
        # auth_message — information about the account for which the password was reset
        'auth': "UPDATE auth_user SET `password`",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /auth/v4/user/100007/password"
    },
    # Locking and unlocking an account
    'user_lock_toggle': {
        # proxy_message1 — query type (POST /user/<ID>/suspend — locking an account, POST /user/<ID>/resume — unlocking an account)
        'proxy1': "Begin processing request target: '/user/<ID>/suspend'",
        'proxy2': "Begin processing request target: '/user/100007/resume'",
        # proxy_message2 — information about the account that requested the operation
        'auth_info': "Auth roles",
        # auth_message — information about a blocked or unblocked account
        'auth1': "UPDATE auth_user SET `state`='disabled'",
        'auth2': "UPDATE auth_user SET `state`='active'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/user/<ID>/suspend",
        'input2': "POST /auth/v4/user/<ID>/resume"
    },
    # Creating and deleting a group
    'acl_group_create_delete': {
        # proxy_message1 — query type (POST /acl — creating ACL group, DELETE /acl/<ID> — deleting ACL group)
        'proxy1': "Begin processing request target: '/public/global/whoami/method/POST/target/%2Facl'",
        'proxy2': "Begin processing request target: '/public/global/whoami/method/DELETE/target/%2Facl%2F1'",
        # proxy_message2 — information about the account that requested the operation
        'proxy_info': "Auth response body",
        # auth_message — information about the created or deleted ACL group
        'auth1': "INSERT INTO auth_acl",
        'auth2': "DELETE FROM auth_acl WHERE",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/acl",
        'input2': "DELETE /auth/v4/acl"
    },
    # Adding to and removing from a group
    'user_acl_membership': {
        # proxy_message1 — query type (POST /auth/v4/acl/<ID>/user/<ID> — adding to an ACL group, DELETE /auth/v4/acl/<ID>/user/<ID> — and removing from an ACL group)
        'proxy1': "Begin processing request target: '/user/100000/method/POST/target/%2Facl%2F3%2Fuser%2F100007'",
        'proxy2': "Begin processing request target: '/user/100000/method/DELETE/target/%2Facl%2F3%2Fuser%2F100007'",
        # proxy_message2 — information about the account that requested the operation
        'proxy_info': "Auth roles",
        # auth_message — information about connections created or deleted between an account and a group
        'auth1': "INSERT INTO auth_user2acl",
        'auth2': "DELETE FROM auth_user2acl WHERE",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/acl/<ID>/user/<ID>",
        'input2': "DELETE /auth/v4/acl/<ID>/user/<ID>"
    },
    # Deleting an active session
    'session_delete': {
        # proxy_message1 — query type (DELETE /auth/v4/session/<ID> — deleting an active authorization session)
        'proxy1': "Begin processing request target: '/public/global/whoami/method/DELETE/target/%2Fsession%2F10000003'",
        # proxy_message2 — information about the account that requested the operation
        'proxy2': "Auth response body",
        # auth_message — ID
        'auth': "DELETE FROM auth_token WHERE",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "DELETE /auth/v4/session/<ID>"
    },
    # Adding and deleting an SSH key
    'ssh_key_manage': {
        # proxy_message1 — query type (POST /auth/v4/self/sshkey — adding a key, DELETE /auth/v4/self/sshkey/<ID> — deleting a key)
        'proxy1': "Begin processing request target: '/public/global/whoami/method/POST/target/%2Fself%2Fsshkey'",
        'proxy2': "Begin processing request target: '/public/global/whoami/method/DELETE/target/%2Fself%2Fsshkey%2F1'",
        # proxy_message2 — information about the account that requested the operation
        'proxy_info': "Auth response body",
        # auth_message — info about the created or deleted key
        'auth1': "INSERT INTO auth_user_sshkey",
        'auth2': "DELETE FROM auth_user_sshkey WHERE",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /auth/v4/self/sshkey",
        'input2': "DELETE /auth/v4/self/sshkey/1"
    },
    # Enabling and disabling maintenance mode
    'maintenance_toggle': {
        # proxy_message — query type (POST /server/{server_id} — changing a server settings)
        'proxy': "Begin processing request target: '/server/<ID>",
        # dci_writer_message1 — settings sent via API request
        'dci1': 'RequestBody: {"maintenance":true}',
        'dci2': 'RequestBody: {"maintenance":false}',
        # dci_writer_message2 — making changes to a DB
        'dci3': "UPDATE dci_server SET maintenance='1' WHERE id=<ID>",
        'dci4': "UPDATE dci_server SET maintenance='0' WHERE id=<ID>",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>"
    },
    # Blocking and unblocking the server
    'server_suspend_resume': {
        # proxy_message — query type (POST /server/{server_id}/suspend — blocking the server, POST /server/{server_id}/resume — unblocking the server)
        'proxy1': "Begin processing request target: '/server/<ID>/suspend",
        'proxy2': "Begin processing request target: '/server/<ID>/resume",
        # dci_writer_message — making changes to a DB
        'dci1': "UPDATE dci_server SET state='suspending' WHERE id=<ID>",
        'dci2': "UPDATE dci_server SET state='resuming' WHERE id=<ID>",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /dci/v3/server/<ID>/suspend",
        'input2': "POST /dci/v3/server/<ID>/resume"
    },
    # Enabling and disabling automatic change of the server boot order in BIOS/UEFI
    'boot_order_auto_toggle': {
        # proxy_message — query type (POST /setting/operation_change_boot_order — enabling or automatically changing the boot order)
        'proxy': "Begin processing request target: '/setting/operation_change_boot_order'",
        # dci_writer_message — making changes to a DB (value='true' — enabling, value='false' — disabling)
        'dci1': "UPDATE isp_settings SET value='true' WHERE name='operation_change_boot_order'",
        'dci2': "UPDATE isp_settings SET value='false' WHERE name='operation_change_boot_order'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /api/dci/v3/setting/operation_change_boot_order"
    },
    # Changing the mechanism or order of server boot in BIOS/UEFI
    'bios_boot_settings_change': {
        # proxy_message — query type (POST /server/{server_id} — changing the server settings)
        'proxy': "Begin processing request target: '/server/<ID>",
        # dci_writer_message1 — settings sent via API request
        'dci1': 'RequestBody: {"settings"',
        # dci_writer_message2 — making changes to a DB
        'dci2': "UPDATE dci_server SET settings=",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>"
    },
    # Changing the main IP address of the server
    'server_main_ip_change': {
        # proxy_message — query type (POST /server/{server_id} — changing the server settings)
        'proxy': "Begin processing request target: '/server/<ID>",
        # dci_writer_message1 — settings sent via API request
        'dci1': 'RequestBody: {"main_ip',
        # dci_writer_message2 — making changes to a DB
        'dci2': "UPDATE dci_server SET main_ip",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>"
    },
    # Creating a network connection
    'switch_connection_create': {
        # proxy_message — query type (POST /server/{server_id}/switch_connection — connectng to a switch)
        'proxy': "Begin processing request target: '/server/<ID>/switch_connection'",
        # dci_writer_message1 — settings sent via API request (port ID)
        'dci1': 'RequestBody: {"switch_port_id"',
        # dci_writer_message2 — making changes to a DB
        'dci2': "UPDATE dci_switch_port SET connection_type='server'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>/switch_connection"
    },
    # Deleting a network connection
    'switch_connection_delete': {
        # proxy_message — query type (DELETE /server/{server_id}/switch_connection — deleting the connection to the port)
        'proxy': "No schema handler for target: DELETE /server/<ID>/switch_connection/<ID>",
        # dci_writer_message — making changes to a DB
        'dci': "DELETE FROM dci_server_to_switch_port WHERE id=",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "DELETE /dci/v3/server/<ID>/switch_connection/<ID>"
    },
    # Assigning an IP address to the server
    'server_ip_assign': {
        # proxy_message — query type (POST /server/{server_id}/ip — adding an IP address)
        'proxy': "Begin processing request target: '/server/<ID>/ip'",
        # dci_writer_message1 — settings sent via API request (for example, IP pool ID and domain name)
        'dci1': 'RequestBody: {"domain"',
        # dci_writer_message2 — making changes to a DB
        'dci2': "INSERT INTO dci_server_ip",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>/ip"
    },
    # Editing the server's IP address settings
    'server_ip_edit': {
        # proxy_message — query type (POST /ip/{ip_id} — editing the IP address)
        'proxy': "Begin processing request target: '/ip/<ID>'",
        # dci_writer_message — making changes to a DB
        'dci': "UPDATE dci_server_ip",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/ip/<ID>"
    },
    # Deleting the server's IP address
    'server_ip_delete': {
        # proxy_message — query type (DELETE /server/{server_id}/ip/{ip_id} — deleting an IP address)
        'proxy': "No schema handler for target: DELETE /server/12/ip/11",
        # dci_writer_message — making changes to a DB
        'dci': "UPDATE dci_server_ip SET status='deleting'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/ip/<ID>"
    },
    # Editing the switch port settings
    'switch_port_edit': {
        # proxy_message — query type (POST /switch/{switch_id}/port/{port_id} — changing the port settings)
        'proxy': "Begin processing request target: '/switch/<ID>/port/<ID>'",
        # dci_writer_message — making changes to a DB
        'dci': "UPDATE dci_switch_port",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/switch/<ID>/port/<ID>"
    },
    # Enabling and disabling the switch port
    'switch_port_power_toggle': {
        # proxy_message — query type (POST /switch/{switch_id}/port/{port_id}/down — disabling the port, POST /switch/{switch_id}/port/{port_id}/up — enabling the port)
        'proxy1': "Begin processing request target: '/switch/<ID>/port/<ID>/down'",
        'proxy2': "Begin processing request target: '/switch/<ID>/port/<ID>/up'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /dci/v3/switch/<ID>/port/<ID>/down",
        'input2': "POST /dci/v3/switch/<ID>/port/<ID>/up"
    },
    # Turning the PDU port on and off
    'pdu_port_power_toggle': {
        # proxy_message — query type (POST /pdu/{pdu_id}/port/{port_id}/down — disabling the port, POST /pdu/{pdu_id}/port/{port_id}/up — enabling the port)
        'proxy1': "Begin processing request target: '/pdu/<ID>/port/<ID>/down'",
        'proxy2': "Begin processing request target: '/pdu/<ID>/port/<ID>/up'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /dci/v3/pdu/<ID>/port/<ID>/down",
        'input2': "POST /dci/v3/pdu/<ID>/port/<ID>/up"
    },
    # Turning the server on, off, and restarting it
    'server_power_control': {
        # proxy_message — query type (POST /server/{server_id}/power_off — power off, POST /server/{server_id}/power_on — power on, POST /server/{server_id}/power_reset — reset)
        'proxy1': "Begin processing request target: '/server/<ID>/power_on'",
        'proxy2': "Begin processing request target: '/server/<ID>/power_off'",
        'proxy3': "Begin processing request target: '/server/<ID>/power_reset'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input1': "POST /dci/v3/server/<ID>/power_on",
        'input2': "POST /dci/v3/server/<ID>/power_off",
        'input3': "POST /dci/v3/server/<ID>/power_reset"
    },
    # Editing the server BIOS settings
    'bios_settings_edit': {
        # proxy_message — query type (POST /ipmi/{ipmi_id}/bios_attr — changing the BIOS settings)
        'proxy': "Begin processing request target: '/ipmi/17/bios_attr'",
        # dci_writer_message — list of edited setting and their values
        'dci': 'RequestBody: {"attributes"',
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /api/dci/v3/ipmi/17/bios_attr"
    },
    # Creating a server profile
    'server_profile_create': {
        # proxy_message — query type (POST /server_profile — creating a profile)
        'proxy': "Begin processing request target: '/server_profile'",
        # dci_writer_message1 — ID 
        'dci1': 'RequestBody: {"location":<ID>,"model"',
        # dci_writer_message2 — making changes to a DB
        'dci2': "INSERT INTO dci_server_profile",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server_profile"
    },
    # Editing a server profile
    'server_profile_edit': {
        # proxy_message — query type (POST /server_profile/{server_profile_id} — changing the profile settings)
        'proxy': "Begin processing request target: '/server_profile/<ID>'",
        # dci_writer_message1 — ID of dci_writer thread
        'dci1': "dci_writer[<ID>]: request method: POST url: /server_profile/<ID>",
        # dci_writer_message2 — request parameters (profile settings and their new values)
        'dci2': "dci_writer[<ID>]: RequestBody",
        # dci_writer_message3 — making changes to a DB
        'dci3': "UPDATE dci_server_profile",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server_profile/2"
    },
    # Linking a profile to a server
    'server_profile_assign': {
        # proxy_message — query type (POST /server/{server_id}/server_profile — changing a profile link)
        'proxy': "Begin processing request target: '/server/<ID>/server_profile'",
        # dci_writer_message1 — request parameters (profile ID)
        'dci1': 'RequestBody: {"server_profile_id"',
        # dci_writer_message2 — making changes to a DB
        'dci2': "dci_writer[<ID>]: RequestBody",
        # dci_writer_message3 — making changes to a DB
        'dci3': "INSERT INTO dci_server_profile_to_server",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>/server_profile"
    },
    # Applying profile settings to a server
    'server_profile_apply': {
        # proxy_message — query type (POST /server/{server_id}/server_profile/{server_profile_id} — applying the profile settings)
        'proxy': "Begin processing request target: '/server/<ID>/server_profile/<ID>'",
        # input_message — the result of the operation and the IP address from which the request was sent
        'input': "POST /dci/v3/server/<ID>/server_profile/<ID>"
    }
}

while p.poll():
    if j.process() != journal.APPEND:
        continue

    for entry in j:
        message = entry.get('MESSAGE', '')
        matched_event = None

        # Check all events and their templates
        for event_name, patterns in filters.items():
            if any(matches_template(message, pattern) for pattern in patterns.values()):
                matched_event = event_name
                break

        if matched_event:
            timestamp = entry.get('__REALTIME_TIMESTAMP', '')
            print(f"[{matched_event}] {timestamp} {message}")