network.detectors
Class FileChangedEventDetector

java.lang.Object
  network.detectors.EventDetector
      network.detectors.FileChangedEventDetector

All Implemented Interfaces:

java.lang.Runnable, java.io.Serializable

public class FileChangedEventDetector

extends EventDetector

implements java.io.Serializable

See Also:

Serialized Form

Field Summary

Fields inherited from class network.detectors.EventDetector

agentURN, cred, dbModule, eventIDGenerator, eventTable, host, localTriggeringEvents, remoteTriggeringEvents, reportTable

Constructor Summary

FileChangedEventDetector(ConfigObject configObj)

FileChangedEventDetector(java.lang.String input, ConfigObject configObj)

FileChangedEventDetector(java.util.Vector localtriggeringEventClassNames, java.util.Vector remotetriggeringEventClassNames, ConfigObject configObj)

Method Summary

java.util.Vector	check(java.util.Vector Signatures) This method is for comparing the files after the monitor Agent sends the FileSign vector
FileChangedEvent	compare(network.detectors.util.FileName fn, network.detectors.util.FileSign fs, network.detectors.util.FileSign fsign, java.lang.String hname) Compare the received file signature with the one in the database.
java.util.Vector	generateEvent(Event triggeredEvent)
java.lang.String	getGeneratingEventClassName()

Methods inherited from class network.detectors.EventDetector

getAlarmLevel, getAlertLevel, getLocalTriggeringEventClassNames, getRemoteTriggeringEventClassNames, getSynchronizer, InitializeFields, modifyDetector, populatePatterns, printRunningThreads, run, setAgentURN, setAlarmLevel, setAlertLevel, setDB, setEventIDGenerator, setEventTable, setLocalTriggeringEvents, setRemoteTriggeringEvents, setReportTable, stopDetector, switchOffPrintRunningThreads

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

FileChangedEventDetector

public FileChangedEventDetector(ConfigObject configObj)

FileChangedEventDetector

public FileChangedEventDetector(java.lang.String input,
                                ConfigObject configObj)

Parameters:

input - a string that contains the dburl, dbuser, and dbpassword of the sign and event databases

configObj -

FileChangedEventDetector

public FileChangedEventDetector(java.util.Vector localtriggeringEventClassNames,
                                java.util.Vector remotetriggeringEventClassNames,
                                ConfigObject configObj)

Method Detail

getGeneratingEventClassName

public java.lang.String getGeneratingEventClassName()

Specified by:

getGeneratingEventClassName in class EventDetector

Returns:

generateEvent

public java.util.Vector generateEvent(Event triggeredEvent)

Specified by:

generateEvent in class EventDetector

Parameters:

triggeredEvent -

Returns:

check

public java.util.Vector check(java.util.Vector Signatures)
                       throws java.rmi.RemoteException

This method is for comparing the files after the monitor Agent sends the FileSign vector

Parameters:

Signatures - a vector of file signatures.

Returns:

a vector possibly containing a FileChangedEvent

Throws:

java.rmi.RemoteException

compare

public FileChangedEvent compare(network.detectors.util.FileName fn,
                                network.detectors.util.FileSign fs,
                                network.detectors.util.FileSign fsign,
                                java.lang.String hname)

Compare the received file signature with the one in the database.

FileChangedEvents are generated based on whether or not fs's signature differs from fsign's. If the event is generated it must go through more checks to see if it should be readded to the events database. The event is readded if any of its signature (except the timestamp) differs from the result of a query on the events database.

Parameters:

fn - a FileName object for the current filename (stores information about what in the file's signature we should check

fs - a FileSign object that we wish to check

fsign - a FileSign object that we check against (a FileSign version of this file's entry in the sign database)

hname - a string that is the hostname

Returns:

null if we did not generate a FileChangedEvent or a FileChangedEvent if we generated one