cfenvd.c File Reference

#include "../pub/getopt.h"
#include "cf.defs.h"
#include "cf.extern.h"
#include <math.h>
#include <db.h>

Go to the source code of this file.

Defines
#define	LOADAVG_5MIN   1
#define	CFGRACEPERIOD   4.0
Enumerations
enum	socks {   netbiosns, netbiosdgm, netbiosssn, irc,   cfengine, nfsd, smtp, www,   ftp, ssh, telnet }
Functions
void CheckOptsAndInit	ARGLIST ((int argc, char **argv))
int	main (int argc, char **argv)
void	CheckOptsAndInit (int argc, char **argv)
void	Syntax ()
void	GetDatabaseAge ()
void	LoadHistogram ()
void	DoBatch ()
void	StartServer (int argc, char **argv)
void	yyerror (char *s)
void	RotateFiles (char *name, int number)
void	FatalError (char *s)
void	GetQ ()
char *	GetTimeKey ()
Averages	EvalAvQ (char *t)
void	ArmClasses (struct Averages av, char *timekey)
void	GatherProcessData ()
void	GatherDiskData ()
void	GatherLoadData ()
void	GatherSocketData ()
void	GatherPhData ()
Averages *	GetCurrentAverages (char *timekey)
void	UpdateAverages (char *timekey, struct Averages newvals)
void	UpdateDistributions (char *timekey, struct Averages *av)
double	WAverage (double anew, double aold, double age)
void	SetClasses (double expect, double delta, double sigma, double lexpect, double ldelta, double lsigma, char *name, struct Item **classlist, char *timekey)
void	SetVariable (char *name, double value, double average, double stddev, struct Item **classlist)
void	RecordChangeOfState (struct Item *classlist, char *timekey)
double	RejectAnomaly (double new, double average, double variance, double localav, double localvar)
int	HashPhKey (char *key)
int	RecursiveTidySpecialArea (char *name, struct Tidy *tp, int maxrecurse, struct stat *sb)
int	Repository (char *file, char *repository)
Variables
unsigned int	HISTOGRAM [ATTR *2+5+PH_LIMIT][7][GRAINS]
int	HISTO = false
int	NUMBER_OF_USERS
int	ROOTPROCS
int	OTHERPROCS
int	DISKFREE
int	LOADAVG
int	INCOMING [ATTR]
int	OUTGOING [ATTR]
int	PH_SAMP [PH_LIMIT]
int	PH_LAST [PH_LIMIT]
int	PH_DELTA [PH_LIMIT]
int	SLEEPTIME = 5 * 60
int	BATCH_MODE = false
double	ITER = 0.0
double	AGE
double	WAGE
char	OUTPUT [bufsize *2]
char	BATCHFILE [bufsize]
char	STATELOG [bufsize]
char	ENV_NEW [bufsize]
char	ENV [bufsize]
Averages	LOCALAV
Item *	ALL_INCOMING = NULL
Item *	ALL_OUTGOING = NULL
double	ENTROPY = 0.0
double	LAST_HOUR_ENTROPY = 0.0
double	LAST_DAY_ENTROPY = 0.0
Item *	PREVIOUS_STATE = NULL
option	CFDENVOPTIONS []
short	NO_FORK = false
char *	ECGSOCKS [ATTR][2]
char *	PH_BINARIES [PH_LIMIT]

---

Define Documentation

#define CFGRACEPERIOD   4.0

Definition at line 51 of file cfenvd.c. Referenced by EvalAvQ().

#define LOADAVG_5MIN   1

Definition at line 42 of file cfenvd.c. Referenced by GatherLoadData().

---

Enumeration Type Documentation

enum socks

Enumerator: netbiosns  netbiosdgm  netbiosssn  irc  cfengine  nfsd  smtp  www  ftp  ssh  telnet  Definition at line 103 of file cfenvd.c. { netbiosns, netbiosdgm, netbiosssn, irc, cfengine, nfsd, smtp, www, ftp, ssh, telnet };

---

Function Documentation

void CheckOptsAndInit ARGLIST (  (int argc, char **argv)   )

void ArmClasses (  struct Averages  av, char *  timekey )

Definition at line 811 of file cfenvd.c. References ATTR, CanonifyName(), Debug, DeleteItemList(), DISKFREE, ECGSOCKS, ENV, ENV_NEW, Averages::expect_diskfree, Averages::expect_incoming, Averages::expect_loadavg, Averages::expect_number_of_users, Averages::expect_otherprocs, Averages::expect_outgoing, Averages::expect_pH, Averages::expect_rootprocs, fp, i, INCOMING, isdigit, LOADAVG, Item::name, NULL, NUMBER_OF_USERS, OTHERPROCS, OUTGOING, PH_BINARIES, PH_DELTA, PH_LIMIT, ROOTPROCS, SetClasses(), SetVariable(), sp, Averages::var_diskfree, Averages::var_incoming, Averages::var_number_of_users, Averages::var_otherprocs, Averages::var_outgoing, Averages::var_pH, and Averages::var_rootprocs. Referenced by StartServer(). { double sigma,delta,lsigma,ldelta; struct Item *classlist = NULL, *ip; int i; FILE *fp; delta = NUMBER_OF_USERS - av.expect_number_of_users; sigma = sqrt(av.var_number_of_users); ldelta = NUMBER_OF_USERS - LOCALAV.expect_number_of_users; lsigma = sqrt(LOCALAV.var_number_of_users); SetClasses(av.expect_number_of_users,delta,sigma, LOCALAV.expect_number_of_users,ldelta,lsigma, "Users",&classlist,timekey); SetVariable("users",NUMBER_OF_USERS,av.expect_number_of_users,lsigma,&classlist); delta = ROOTPROCS - av.expect_rootprocs; sigma = sqrt(av.var_rootprocs); ldelta = ROOTPROCS - LOCALAV.expect_rootprocs; lsigma = sqrt(LOCALAV.var_rootprocs); SetClasses(av.expect_rootprocs,delta,sigma, LOCALAV.expect_rootprocs,ldelta,lsigma, "RootProcs",&classlist,timekey); SetVariable("rootprocs",ROOTPROCS,av.expect_rootprocs,lsigma,&classlist); delta = OTHERPROCS - av.expect_otherprocs; sigma = sqrt(av.var_otherprocs); ldelta = OTHERPROCS - LOCALAV.expect_otherprocs; lsigma = sqrt(LOCALAV.var_otherprocs); SetClasses(av.expect_otherprocs,delta,sigma, LOCALAV.expect_otherprocs,ldelta,lsigma, "UserProcs",&classlist,timekey); SetVariable("userprocs",OTHERPROCS,av.expect_otherprocs,lsigma,&classlist); delta = DISKFREE - av.expect_diskfree; sigma = sqrt(av.var_diskfree); ldelta = DISKFREE - LOCALAV.expect_diskfree; lsigma = sqrt(LOCALAV.var_diskfree); SetClasses(av.expect_diskfree,delta,sigma, LOCALAV.expect_diskfree,ldelta,lsigma, "DiskFree",&classlist,timekey); SetVariable("diskfree",DISKFREE,av.expect_diskfree,lsigma,&classlist); SetClasses(av.expect_loadavg,delta,sigma, LOCALAV.expect_loadavg,ldelta,lsigma, "LoadAvg",&classlist,timekey); SetVariable("loadavg",LOADAVG,av.expect_loadavg,lsigma,&classlist); for (i = 0; i < ATTR; i++) { char name[256]; strcpy(name,ECGSOCKS[i][1]); strcat(name,"_in"); delta = INCOMING[i] - av.expect_incoming[i]; sigma = sqrt(av.var_incoming[i]); ldelta = INCOMING[i] - LOCALAV.expect_incoming[i]; lsigma = sqrt(LOCALAV.var_incoming[i]); SetClasses(av.expect_incoming[i],delta,sigma, LOCALAV.expect_incoming[i],ldelta,lsigma, name,&classlist,timekey); SetVariable(name,INCOMING[i],av.expect_incoming[i],lsigma,&classlist); strcpy(name,ECGSOCKS[i][1]); strcat(name,"_out"); delta = OUTGOING[i] - av.expect_outgoing[i]; sigma = sqrt(av.var_outgoing[i]); ldelta = OUTGOING[i] - LOCALAV.expect_outgoing[i]; lsigma = sqrt(LOCALAV.var_outgoing[i]); SetClasses(av.expect_outgoing[i],delta,sigma, LOCALAV.expect_outgoing[i],ldelta,lsigma, name,&classlist,timekey); SetVariable(name,OUTGOING[i],av.expect_outgoing[i],lsigma,&classlist); } for (i = 0; i < PH_LIMIT; i++) { if (PH_BINARIES[i] == NULL) { continue; } delta = PH_DELTA[i] - av.expect_pH[i]; sigma = sqrt(av.var_pH[i]); ldelta = PH_DELTA[i] - LOCALAV.expect_pH[i]; lsigma = sqrt(LOCALAV.var_pH[i]); SetClasses(av.expect_pH[i],delta,sigma, LOCALAV.expect_pH[i],ldelta,lsigma, CanonifyName(PH_BINARIES[i]),&classlist,timekey); SetVariable(CanonifyName(PH_BINARIES[i]),PH_DELTA[i],av.expect_pH[i],lsigma,&classlist); } /* if (WAGE > CFGRACEPERIOD) { if (!OrderedListsMatch(PREVIOUS_STATE,classlist)) { RecordChangeOfState(classlist,timekey); } } */ unlink(ENV_NEW); if ((fp = fopen(ENV_NEW,"w")) == NULL) { DeleteItemList(PREVIOUS_STATE); PREVIOUS_STATE = classlist; return; } for (ip = classlist; ip != NULL; ip=ip->next) { fprintf(fp,"%s\n",ip->name); } DeleteItemList(PREVIOUS_STATE); PREVIOUS_STATE = classlist; for (ip = ALL_INCOMING; ip != NULL; ip=ip->next) { char *sp; int print=true; for (sp = ip->name; *sp != '\0'; sp++) { if (!isdigit((int)*sp)) { print = false; } } if (print) { Debug("Port(in,%s) ",ip->name); fprintf(fp,"pin-%s\n",ip->name); } } Debug("\n\n"); for (ip = ALL_OUTGOING; ip != NULL; ip=ip->next) { char *sp; int print=true; for (sp = ip->name; *sp != '\0'; sp++) { if (!isdigit((int)*sp)) { continue; } } if (print) { Debug("Port(out,%s) ",ip->name); /* fprintf(fp,"pout-%s\n",ip->name); */ } } Debug("\n\n"); fclose(fp); rename(ENV_NEW,ENV); }

void CheckOptsAndInit (  int  argc, char **  argv )

Definition at line 206 of file cfenvd.c. References ATTR, AVDB, AVDB_FILE, BATCH_MODE, BATCHFILE, bufsize, CFLOCK, COPYRIGHT, CreateEmptyFile(), D1, D2, DEBUG, ECGSOCKS, ENV, ENV_FILE, ENV_NEW, ENV_NEW_FILE, Averages::expect_diskfree, Averages::expect_incoming, Averages::expect_loadavg, Averages::expect_number_of_users, Averages::expect_otherprocs, Averages::expect_outgoing, Averages::expect_pH, Averages::expect_rootprocs, GetDatabaseAge(), getopt_long(), GRAINS, HISTO, HISTOGRAM, i, IGNORELOCK, j, k, LoadHistogram(), LOGGING, MakeDirectoriesFor(), NO_FORK, NULL, optarg, OUTPUT, PH_LAST, PH_LIMIT, PH_SAMP, snprintf(), STATELOG, STATELOG_FILE, Syntax(), Averages::var_diskfree, Averages::var_incoming, Averages::var_loadavg, Averages::var_number_of_users, Averages::var_otherprocs, Averages::var_outgoing, Averages::var_pH, Averages::var_rootprocs, VBUFF, VERBOSE, VLOCKDIR, VLOGDIR, and VPREFIX. Referenced by main(). { extern char *optarg; int optindex = 0; int c, i,j,k; umask(077); sprintf(VPREFIX,"cfenvd"); openlog(VPREFIX,LOG_PID|LOG_NOWAIT|LOG_ODELAY,LOG_DAEMON); strcpy(CFLOCK,"cfenvd"); IGNORELOCK = false; OUTPUT[0] = '\0'; while ((c=getopt_long(argc,argv,"d:f:vhHFV",CFDENVOPTIONS,&optindex)) != EOF) { switch ((char) c) { case 'd': switch ((optarg==NULL)?3:*optarg) { case '1': D1 = true; break; case '2': D2 = true; break; default: DEBUG = true; break; } NO_FORK = true; printf("cfenvd: Debug mode: running in foreground\n"); break; case 'f': /* This is for us Oslo folks to test against old data in batch */ strcpy(BATCHFILE,optarg); NO_FORK = true; BATCH_MODE = true; printf("Working in batch mode on file %s\n",BATCHFILE); break; case 'v': VERBOSE = true; break; case 'V': printf("GNU %s-%s daemon\n%s\n",PACKAGE,VERSION,COPYRIGHT); printf("This program is covered by the GNU Public License and may be\n"); printf("copied free of charge. No warrenty is implied.\n\n"); exit(0); break; case 'F': NO_FORK = true; break; case 'H': HISTO = true; break; default: Syntax(); exit(1); } } LOGGING = true; /* Do output to syslog */ sprintf(VBUFF,"%s/test",WORKDIR); MakeDirectoriesFor(VBUFF,'y'); sprintf(VBUFF,"%s/state/test",WORKDIR); MakeDirectoriesFor(VBUFF,'y'); strncpy(VLOCKDIR,WORKDIR,bufsize-1); strncpy(VLOGDIR,WORKDIR,bufsize-1); for (i = 0; i < ATTR; i++) { sprintf(VBUFF,"%s/state/cf_incoming.%s",WORKDIR,ECGSOCKS[i][1]); CreateEmptyFile(VBUFF); sprintf(VBUFF,"%s/state/cf_outgoing.%s",WORKDIR,ECGSOCKS[i][1]); CreateEmptyFile(VBUFF); } sprintf(VBUFF,"%s/state/cf_users",WORKDIR); CreateEmptyFile(VBUFF); snprintf(AVDB,bufsize,"%s/state/%s",WORKDIR,AVDB_FILE); snprintf(STATELOG,bufsize,"%s/state/%s",WORKDIR,STATELOG_FILE); snprintf(ENV_NEW,bufsize,"%s/state/%s",WORKDIR,ENV_NEW_FILE); snprintf(ENV,bufsize,"%s/state/%s",WORKDIR,ENV_FILE); if (!BATCH_MODE) { GetDatabaseAge(); LOCALAV.expect_number_of_users = 0.0; LOCALAV.expect_rootprocs = 0.0; LOCALAV.expect_otherprocs = 0.0; LOCALAV.expect_diskfree = 0.0; LOCALAV.expect_loadavg = 0.0; LOCALAV.var_number_of_users = 0.0; LOCALAV.var_rootprocs = 0.0; LOCALAV.var_otherprocs = 0.0; LOCALAV.var_diskfree = 0.0; LOCALAV.var_loadavg = 0.0; for (i = 0; i < ATTR; i++) { LOCALAV.expect_incoming[i] = 0.0; LOCALAV.expect_outgoing[i] = 0.0; LOCALAV.var_incoming[i] = 0.0; LOCALAV.var_outgoing[i] = 0.0; } for (i = 0; i < PH_LIMIT; i++) { LOCALAV.expect_pH[i] = 0.0; LOCALAV.var_pH[i] = 0.0; } } for (i = 0; i < 7; i++) { for (j = 0; j < ATTR*2+5+PH_LIMIT; j++) { for (k = 0; k < GRAINS; k++) { HISTOGRAM[i][j][k] = 0; } } } for (i = 0; i < PH_LIMIT; i++) { PH_SAMP[i] = PH_LAST[i] = 0.0; } srand((unsigned int)time(NULL)); LoadHistogram(); }

void DoBatch (   )

Definition at line 467 of file cfenvd.c. References AVDB, BATCHFILE, bzero, cfengine, cferror, CfLog(), ConvTimeKey(), Debug, DISKFREE, errno, EvalAvQ(), fp, ftp, i, INCOMING, nfsd, NULL, NUMBER_OF_USERS, OTHERPROCS, OUTGOING, OUTPUT, ROOTPROCS, smtp, ssh, telnet, and www. Referenced by main(). { FILE *fp; char buffer[4096],time[256],timekey[256]; float v1,v2,v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15,v16,v17,v18,v19,v20,v21,v22,v23,v24,v25,v26; DB *dbp; int i = 0; sprintf(AVDB,"/tmp/cfenv.tmp.db"); unlink(AVDB); if ((errno = db_create(&dbp,NULL,0)) != 0) { sprintf(OUTPUT,"Couldn't open average database %s\n",AVDB); CfLog(cferror,OUTPUT,"db_open"); return; } #ifdef CF_OLD_DB if ((errno = dbp->open(dbp,AVDB,NULL,DB_BTREE,DB_CREATE,0644)) != 0) #else if ((errno = dbp->open(dbp,NULL,AVDB,NULL,DB_BTREE,DB_CREATE,0644)) != 0) #endif { sprintf(OUTPUT,"Couldn't open average database %s\n",AVDB); CfLog(cferror,OUTPUT,"db_open"); return; } if ((fp=fopen(BATCHFILE,"r")) == NULL) { printf("Cannot open %s\n",BATCHFILE); return; } while (!feof(fp)) { bzero(buffer,4096); fgets(buffer,1024,fp); if (i++ % 1024 == 0) { printf(" * Working %d ... *\r",i); } sscanf(buffer,"%[^,],%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f%*c%f",time,&v1,&v2,&v3,&v4,&v5,&v6,&v7,&v8,&v9,&v10,&v11,&v12,&v13,&v14,&v15,&v16,&v17,&v18,&v19,&v20,&v21,&v22,&v23,&v24,&v25,&v26); Debug("%s,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f,%f",time,v1,v2,v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15,v16,v17,v18,v19,v20,v21,v22,v23,v24,v25,v26); NUMBER_OF_USERS = (double)v1; ROOTPROCS = (double)v4; OTHERPROCS = (double)v5; DISKFREE = (double)v6; INCOMING[cfengine] = (double)v13; OUTGOING[cfengine] = (double)v14; INCOMING[nfsd] = (double)v15; OUTGOING[nfsd] = (double)v16; INCOMING[smtp] = (double)v17; OUTGOING[smtp] = (double)v18; INCOMING[www] = (double)v19; OUTGOING[www] = (double)v20; INCOMING[ftp] = (double)v21; OUTGOING[ftp] = (double)v22; INCOMING[ssh] = (double)v23; OUTGOING[ssh] = (double)v24; INCOMING[telnet] = (double)v25; OUTGOING[telnet] = (double)v26; strcpy(timekey,ConvTimeKey(time)); (void)EvalAvQ(timekey); } fclose(fp); dbp->close(dbp,0); printf("\nDone - database saved to %s\n",AVDB); printf("Run cfenvgraph -f %s to generate graphs\n\n",AVDB); }

struct Averages EvalAvQ (  char *  t  )

Definition at line 661 of file cfenvd.c. References ATTR, CanonifyName(), cferror, CFGRACEPERIOD, CfLog(), DISKFREE, ECGSOCKS, Averages::expect_diskfree, Averages::expect_incoming, Averages::expect_loadavg, Averages::expect_number_of_users, Averages::expect_otherprocs, Averages::expect_outgoing, Averages::expect_pH, Averages::expect_rootprocs, GetCurrentAverages(), i, INCOMING, ITER, LOADAVG, NULL, NUMBER_OF_USERS, OTHERPROCS, OUTGOING, PH_BINARIES, PH_DELTA, PH_LIMIT, RejectAnomaly(), ROOTPROCS, UpdateAverages(), UpdateDistributions(), Averages::var_diskfree, Averages::var_incoming, Averages::var_loadavg, Averages::var_number_of_users, Averages::var_otherprocs, Averages::var_outgoing, Averages::var_pH, Averages::var_rootprocs, Verbose, WAGE, and WAverage(). Referenced by DoBatch(), and StartServer(). { struct Averages *currentvals,newvals; int i; double Number_Of_Users,Rootprocs,Otherprocs,Diskfree,LoadAvg; double Incoming[ATTR],Outgoing[ATTR],pH_delta[PH_LIMIT]; if ((currentvals = GetCurrentAverages(t)) == NULL) { CfLog(cferror,"Error reading average database",""); exit(1); } /* Discard any apparently anomalous behaviour before renormalizing database */ Number_Of_Users = RejectAnomaly(NUMBER_OF_USERS, currentvals->expect_number_of_users, currentvals->var_number_of_users, LOCALAV.expect_number_of_users, LOCALAV.var_number_of_users); Rootprocs = RejectAnomaly(ROOTPROCS, currentvals->expect_rootprocs, currentvals->var_rootprocs, LOCALAV.expect_rootprocs, LOCALAV.var_rootprocs); Otherprocs = RejectAnomaly(OTHERPROCS, currentvals->expect_otherprocs, currentvals->var_otherprocs, LOCALAV.expect_otherprocs, LOCALAV.var_otherprocs); Diskfree = RejectAnomaly(DISKFREE, currentvals->expect_diskfree, currentvals->var_diskfree, LOCALAV.expect_diskfree, LOCALAV.var_diskfree); LoadAvg = RejectAnomaly(LOADAVG, currentvals->expect_loadavg, currentvals->var_loadavg, LOCALAV.expect_loadavg, LOCALAV.var_loadavg); for (i = 0; i < ATTR; i++) { Incoming[i] = RejectAnomaly(INCOMING[i], currentvals->expect_incoming[i], currentvals->var_incoming[i], LOCALAV.expect_incoming[i], LOCALAV.var_incoming[i]); Outgoing[i] = RejectAnomaly(OUTGOING[i], currentvals->expect_outgoing[i], currentvals->var_outgoing[i], LOCALAV.expect_outgoing[i], LOCALAV.var_outgoing[i]); } for (i = 0; i < PH_LIMIT; i++) { pH_delta[i] = RejectAnomaly(PH_DELTA[i], currentvals->expect_pH[i], currentvals->var_pH[i], LOCALAV.expect_pH[i], LOCALAV.var_pH[i]); } newvals.expect_number_of_users = WAverage(Number_Of_Users,currentvals->expect_number_of_users,WAGE); newvals.expect_rootprocs = WAverage(Rootprocs,currentvals->expect_rootprocs,WAGE); newvals.expect_otherprocs = WAverage(Otherprocs,currentvals->expect_otherprocs,WAGE); newvals.expect_diskfree = WAverage(Diskfree,currentvals->expect_diskfree,WAGE); newvals.expect_loadavg = WAverage(LoadAvg,currentvals->expect_loadavg,WAGE); LOCALAV.expect_number_of_users = WAverage(newvals.expect_number_of_users,LOCALAV.expect_number_of_users,ITER); LOCALAV.expect_rootprocs = WAverage(newvals.expect_rootprocs,LOCALAV.expect_rootprocs,ITER); LOCALAV.expect_otherprocs = WAverage(newvals.expect_otherprocs,LOCALAV.expect_otherprocs,ITER); LOCALAV.expect_diskfree = WAverage(newvals.expect_diskfree,LOCALAV.expect_diskfree,ITER); LOCALAV.expect_loadavg = WAverage(newvals.expect_loadavg,LOCALAV.expect_loadavg,ITER); newvals.var_number_of_users = WAverage((Number_Of_Users-newvals.expect_number_of_users)*(Number_Of_Users-newvals.expect_number_of_users),currentvals->var_number_of_users,WAGE); newvals.var_rootprocs = WAverage((Rootprocs-newvals.expect_rootprocs)*(Rootprocs-newvals.expect_rootprocs),currentvals->var_rootprocs,WAGE); newvals.var_otherprocs = WAverage((Otherprocs-newvals.expect_otherprocs)*(Otherprocs-newvals.expect_otherprocs),currentvals->var_otherprocs,WAGE); newvals.var_diskfree = WAverage((Diskfree-newvals.expect_diskfree)*(Diskfree-newvals.expect_diskfree),currentvals->var_diskfree,WAGE); newvals.var_loadavg = WAverage((LoadAvg-newvals.expect_loadavg)*(LoadAvg-newvals.expect_loadavg),currentvals->var_loadavg,WAGE); LOCALAV.var_number_of_users = WAverage((Number_Of_Users-LOCALAV.expect_number_of_users)*(Number_Of_Users-LOCALAV.expect_number_of_users),LOCALAV.var_number_of_users,ITER); LOCALAV.var_rootprocs = WAverage((Rootprocs-LOCALAV.expect_rootprocs)*(Rootprocs-LOCALAV.expect_rootprocs),LOCALAV.var_rootprocs,ITER); LOCALAV.var_otherprocs = WAverage((Otherprocs-LOCALAV.expect_otherprocs)*(Otherprocs-LOCALAV.expect_otherprocs),LOCALAV.var_otherprocs,ITER); LOCALAV.var_diskfree = WAverage((Diskfree-LOCALAV.expect_diskfree)*(Diskfree-LOCALAV.expect_diskfree),LOCALAV.var_diskfree,ITER); LOCALAV.var_loadavg = WAverage((LoadAvg-LOCALAV.expect_loadavg)*(LoadAvg-LOCALAV.expect_loadavg),currentvals->var_loadavg,WAGE); Verbose("Users = %4d -> (%f#%f) local [%f#%f]\n",NUMBER_OF_USERS,newvals.expect_number_of_users,sqrt(newvals.var_number_of_users),LOCALAV.expect_number_of_users,sqrt(LOCALAV.var_number_of_users)); Verbose("Rootproc = %4d -> (%f#%f) local [%f#%f]\n",ROOTPROCS,newvals.expect_rootprocs,sqrt(newvals.var_rootprocs),LOCALAV.expect_rootprocs,sqrt(LOCALAV.var_rootprocs)); Verbose("Otherproc = %4d -> (%f#%f) local [%f#%f]\n",OTHERPROCS,newvals.expect_otherprocs,sqrt(newvals.var_otherprocs),LOCALAV.expect_otherprocs,sqrt(LOCALAV.var_otherprocs)); Verbose("Diskpercent = %4d -> (%f#%f) local [%f#%f]\n",DISKFREE,newvals.expect_diskfree,sqrt(newvals.var_diskfree),LOCALAV.expect_diskfree,sqrt(LOCALAV.var_diskfree)); Verbose("Load Average = %4d -> (%f#%f) local [%f#%f]\n",LOADAVG,newvals.expect_loadavg,sqrt(newvals.var_loadavg),LOCALAV.expect_loadavg,sqrt(LOCALAV.var_loadavg)); for (i = 0; i < ATTR; i++) { newvals.expect_incoming[i] = WAverage(Incoming[i],currentvals->expect_incoming[i],WAGE); newvals.expect_outgoing[i] = WAverage(Outgoing[i],currentvals->expect_outgoing[i],WAGE); newvals.var_incoming[i] = WAverage((Incoming[i]-newvals.expect_incoming[i])*(Incoming[i]-newvals.expect_incoming[i]),currentvals->var_incoming[i],WAGE); newvals.var_outgoing[i] = WAverage((Outgoing[i]-newvals.expect_outgoing[i])*(Outgoing[i]-newvals.expect_outgoing[i]),currentvals->var_outgoing[i],WAGE); LOCALAV.expect_incoming[i] = WAverage(newvals.expect_incoming[i],LOCALAV.expect_incoming[i],ITER); LOCALAV.expect_outgoing[i] = WAverage(newvals.expect_outgoing[i],LOCALAV.expect_outgoing[i],ITER); LOCALAV.var_incoming[i] = WAverage((Incoming[i]-LOCALAV.expect_incoming[i])*(Incoming[i]-LOCALAV.expect_incoming[i]),LOCALAV.var_incoming[i],ITER); LOCALAV.var_outgoing[i] = WAverage((Outgoing[i]-LOCALAV.expect_outgoing[i])*(Outgoing[i]-LOCALAV.expect_outgoing[i]),LOCALAV.var_outgoing[i],ITER); Verbose("%-15s-in = %4d -> (%f#%f) local [%f#%f]\n",ECGSOCKS[i][1],INCOMING[i],newvals.expect_incoming[i],sqrt(newvals.var_incoming[i]),LOCALAV.expect_incoming[i],sqrt(LOCALAV.var_incoming[i])); Verbose("%-14s-out = %4d -> (%f#%f) local [%f#%f]\n",ECGSOCKS[i][1],OUTGOING[i],newvals.expect_outgoing[i],sqrt(newvals.var_outgoing[i]),LOCALAV.expect_outgoing[i],sqrt(LOCALAV.var_outgoing[i])); } for (i = 0; i < PH_LIMIT; i++) { if (PH_BINARIES[i] == NULL) { continue; } newvals.expect_pH[i] = WAverage(pH_delta[i],currentvals->expect_pH[i],WAGE); newvals.var_pH[i] = WAverage((pH_delta[i]-newvals.expect_pH[i])*(pH_delta[i]-newvals.expect_pH[i]),currentvals->var_pH[i],WAGE); LOCALAV.expect_pH[i] = WAverage(newvals.expect_pH[i],LOCALAV.expect_pH[i],ITER); LOCALAV.var_pH[i] = WAverage((pH_delta[i]-LOCALAV.expect_pH[i])*(pH_delta[i]-LOCALAV.expect_pH[i]),LOCALAV.var_pH[i],ITER); Verbose("%-15s-in = %4d -> (%f#%f) local [%f#%f]\n",CanonifyName(PH_BINARIES[i]),PH_DELTA[i],newvals.expect_pH[i],sqrt(newvals.var_pH[i]),LOCALAV.expect_pH[i],sqrt(LOCALAV.var_pH[i])); } UpdateAverages(t,newvals); if (WAGE > CFGRACEPERIOD) { UpdateDistributions(t,currentvals); /* Distribution about mean */ } return newvals; }

void FatalError (  char *  s  )

Definition at line 615 of file cfenvd.c. References VCURRENTFILE, and VPREFIX. Referenced by AbsLinkPath(), ActionStringToCode(), AddACE(), AddCompoundClass(), AddEditAction(), AddMacroValue(), AddSimpleGidItem(), AddSimpleUidItem(), AddToFstab(), AppendDisable(), AppendImport(), AppendInterface(), AppendItem(), AppendMiscMount(), AppendScript(), AppendTwoDimItem(), AppendUmount(), AuthenticationDialogue(), AuthPathExists(), cf_rstat(), cfopendir(), cfpopen(), cfpopensetuid(), CheckExistingFile(), CheckFileWrapper(), CheckFilters(), CheckImage(), CheckPosixACE(), ChecksumFile(), ChecksumString(), CheckSystemVariables(), CheckVariables(), CheckWorkDirectories(), CommentItemContaining(), CommentItemMatching(), CommentItemStarting(), ConcatLists(), CountEvalAtoms(), DeletePublicKey(), DoTree(), EvaluateAction(), ExpandVarbinserv(), ExpandVarstring(), FileChecksum(), FixCompressedArrayValue(), FunctionStringToCode(), GetLock(), GetMountInfo(), GetNameInfo(), GetResource(), GetSetuidLog(), HandleGroupItem(), HandleId(), HandleItem(), HandlePath(), HandleVarpath(), HavePublicKey(), IfConf(), InsertFileAfter(), InsertItemAfter(), InstallACL(), InstallAuthPath(), InstallBroadcastItem(), InstallDefaultRouteItem(), InstallEditFile(), InstallFileListItem(), InstallFilter(), InstallFilterTest(), InstallImageItem(), InstallLinkChildrenItem(), InstallLinkItem(), InstallLocalInfo(), InstallMailserverPath(), InstallMakePath(), InstallMountableItem(), InstallObject(), InstallProcessItem(), InstallRequiredPath(), InstallStrategy(), InstallTidyPath(), KeyAuthentication(), LinkChildFiles(), LinkChildren(), LoadSecretKeys(), LockLog(), MailCheck(), NegateCompoundClass(), ParseFile(), PreNetConfig(), PrependItem(), PrependTidy(), ReadRCFile(), SavePublicKey(), SendTransaction(), SetDefaultRoute(), SetLock(), ShellCommandReturnsZero(), sockaddr_ntop(), sockaddr_pton(), SplitCommand(), SplitVarstring(), SummarizeParsing(), ToLowerStr(), ToUpperStr(), and yyerror(). { fprintf (stderr,"%s:%s:%s\n",VPREFIX,VCURRENTFILE,s); closelog(); exit(1); }

void GatherDiskData (   )

Definition at line 1048 of file cfenvd.c. References cfpercent, DISKFREE, GetDiskUsage(), and Verbose. Referenced by GetQ(). { DISKFREE = GetDiskUsage("/",cfpercent); Verbose("Disk free = %d %%\n",DISKFREE); }

void GatherLoadData (   )

Definition at line 1058 of file cfenvd.c. References Debug, i, LOADAVG, LOADAVG_5MIN, and Verbose. Referenced by GetQ(). { double load[4] = {0,0,0,0}, sum = 0.0; int i,n = 1; Debug("GatherLoadData\n\n"); #ifdef HAVE_GETLOADAVG if ((n = getloadavg(load,LOADAVG_5MIN)) == -1) { LOADAVG = 0.0; } else { for (i = 0; i < n; i++) { Debug("Found load average to be %lf of %d samples\n", load[i],n); sum += load[i]; } } #endif /* Scale load average by 100 to make it visible */ LOADAVG = (int) (100.0 * sum); Verbose("100 x Load Average = %d\n",LOADAVG); }

void GatherPhData (   )

Definition at line 1215 of file cfenvd.c. References bufsize, CfLog(), cfverbose, Chop(), Debug, dirent, fp, HashPhKey(), i, isdigit, key, NULL, OUTPUT, PH_DELTA, PH_LAST, PH_LIMIT, PH_SAMP, snprintf(), sp, value, and VBUFF. Referenced by GetQ(). { DIR *dirh; struct dirent *dirp; struct stat statbuf; char file[64]; char key[256]; FILE *fp;