在阅读实际行之前，我如何自动解析我打开的 audit.log 文件的语法？

Question

我正在尝试自动解析最初在 Python 程序中打开的日志文件，以便在我开始从文件本身读取实际行之前，其输出采用人类可读的格式。我该怎么做？

with open('/var/log/audit/audit.log') as audit_raw:
    audit_formatted=subprocess.call(["ausearch", "-i", audit_raw])
    line = audit_formatted.readline()

当我尝试这样做时出现错误消息：

Traceback (most recent call last):
  File "./email_script.py", line 29, in <module>
    audit_log=subprocess.call(["ausearch", "-i", audit_raw])
  File "/usr/lib/python3.6/subprocess.py", line 267, in call
    with Popen(*popenargs, **kwargs) as p:
  File "/usr/lib/python3.6/subprocess.py", line 709, in __init__
    restore_signals, start_new_session)
  File "/usr/lib/python3.6/subprocess.py", line 1275, in _execute_child
    restore_signals, start_new_session, preexec_fn)
TypeError: expected str, bytes or os.PathLike object, not _io.TextIOWrapper

Answer 1

您使用正确的参数调用 ausearch 并解析它的输出。

在这里被盗：（这是一个要求图书馆认可的题外话问题）并且可能会从 SO 中消失——这就是我决定不“重复”的原因。

:

import subprocess

def read_audit(before,now,user):
    auparam = " -sc EXECVE"
    cmd = "ausearch -ts " + before.strftime('%H:%M:%S') + " -te " + now.strftime('%H:%M:%S') + " -ua " + user + auparam
    p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
    res = p.stdout.read().decode()
    return res

在阅读实际行之前，我如何自动解析我打开的 audit.log 文件的语法？

How would I automatically parse the syntax of a audit.log file I open before reading actual lines?

python

parsing

subprocess

audit-trail

python-3.x