lighting up LEDs from suricata security alerts

Question

so I am a Python newbie attempting to write a script that will light up a different LED based on the priority level of the latest security alert added to a log file generated by the Suricata Intrusion Detection System... The issue with the script I have now is that it will only read the last log that has been generated before the script is run and light up the according to LED, but not light up different LEDs as more alerts with different levels are added to the log:


    from gpiozero import LED
    from time import sleep

    with open("fast.log") as f:
            last_row = f.readlines()[-1]


    if "[Priority: 2]" in last_row:
            led = LED(18)

            while True:
                led.on()
                sleep(1)
                led.off()
                sleep(1)

    elif "[Priority: 3]" in last_row:
            led = LED(23)

            while True:
                led.on()
                sleep(1)
                led.off()
                sleep(1)

    elif "[Priority: 1]" in last_row:
            led = LED(21)

            while True:
                led.on()
                sleep(1)
                led.off()
                sleep(1)

I am running the script in the background via python3 script.py &

Hi @robreiner, Welcome and nice to meet you. Ah let me see. Your projects is basically in three parts: (1) GpioZero turning on/off LEDs, (2) reading log file to read last row, (3) program p = [Priority: n]" in last_row to select which LED(s) to turn on/off. If I understanding correctly, you problem is in (2). If you can give us (a) flow chart, or (b) decision table, (c) Excel if-then condition worksheet on condition vs LED on/off, / to continue, ... — tlfong01, Jan 06 '20 at 04:54
then I can suggest how to easily convert your flow chart/decision table/work sheet into a background running Rpi4B raspbian 10 buster, Thonny 2.1, python 3.7.3 "dictionary" based script to conditionally control the LEDs. Cheers. — tlfong01, Jan 06 '20 at 04:58
like...dict = {'[Priority: 2]': 'LED(18)', '[Priority: 3]': 'LED(23)', '[Priority: 1]': 'LED(21)'} ? — robreiner, Jan 07 '20 at 23:47
(1)Well, you need to show me at least a partial listing of the function which uses your dict. (2) Actually I did not even spend more than 2.5 seconds looking at your code above or similar elsewhere - whenever I skim, catch the first if-then thing, I would stop and escape to other questions. — tlfong01, Jan 08 '20 at 02:08
(3) I remember when I learnt python 2.7 from an MIT free online course, I heard how the tutor's rule based assignment rejecting rule (sort of non GOTO rule in the 60's when everybody was writing Basic, Fortran, ..), any submitted assignment containing more than two if-then clauses would be immediately rejected. (4) ... / to continue, ... — tlfong01, Jan 08 '20 at 02:08
(4) You might like to skim my NO-IF-THEN-ELSE, pure functional, declarative, rule based style program which I show off in another question: (a) No if-then_else code example: https://penzu.com/public/926a24f6
(b) Accelero Q&A: https://raspberrypi.stackexchange.com/questions/106954/is-there-a-motion-location-sensor-for-rpi-python. By the way, GpioZero is actually a declarative style program. You need to understand the basic declarative style correctly/fully appreciate/make use of it. More about GpioZero's declarative style leter, ... Cheers. — tlfong01, Jan 08 '20 at 02:27
And I NEVER use any C style "switch" clauses, for the following reason: https://penzu.com/p/d2b1dad2. — tlfong01, Jan 08 '20 at 02:42

Dougie · Answer 1 · 2020-01-08T07:13:42.913

3

Move the code that reads the log into your while True: loop. Don't start a new while True: for each LED as it will never terminate.

Now that I'm home and have had a chance to look at this deeper (with a Raspberry Pi to test it on) I've re-written it to use RPi.GPIO (which works).

#!/usr/bin/python3

import RPi.GPIO as g
from time import sleep

g.setmode(g.BCM)
g.setup([18,23,21],g.OUT)

def flashLED(gpioPin):
    g.output(gpioPin,1)
    sleep(0.5)
    g.output(gpioPin,0)
    sleep(0.5)

while True:
    with open("fast.log") as f:
        last_row = f.readlines()[-1]

        # do stuff to light LEDs depending on record read

        if "[Priority: 2]" in last_row:
            flashLED(18)
        elif "[Priority: 3]" in last_row:
            flashLED(23)
        elif "[Priority: 1]" in last_row:
            flashLED(21)

edited Jan 08 '20 at 07:13

answered Jan 06 '20 at 04:42

Dougie

5,301
10
19
28

1

Thanks for the reformatting! - the issue is that the gpioPIN is not recognized as valid syntax, and the documentation I have seen for gpiozero LED always defines led = LED( ) – robreiner Jan 07 '20 at 05:43
1

yeah with the import lines added it still gives me an "define flashLED(gpiopin):" invalid syntax error ... do i need to do something with the devicetree overlay? That is where "gpiopin" is mentioned as a valid string... – robreiner Jan 07 '20 at 15:30
Sorry that's define rather than def is what comes of writing code on a mobile phone in an airport. – Dougie Jan 08 '20 at 07:14

lighting up LEDs from suricata security alerts

1 Answers1