From ec3da3b8e5268bd65abd08b3bfc799178aadcaf0 Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sun, 24 May 2020 11:23:25 +0200
Subject: [PATCH] [mtail] Add radiusd

---
 roles/mtail/tasks/main.yml                   |  1 +
 roles/mtail/templates/mtail/radiusd.mtail.j2 | 47 ++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 roles/mtail/templates/mtail/radiusd.mtail.j2

diff --git a/roles/mtail/tasks/main.yml b/roles/mtail/tasks/main.yml
index b4a419bb..814d0c70 100644
--- a/roles/mtail/tasks/main.yml
+++ b/roles/mtail/tasks/main.yml
@@ -19,6 +19,7 @@
     dest: "/etc/mtail/{{ item }}"
   loop:
     - dhcpd.mtail
+    - radiusd.mtail
   notify: Restart mtail
 
 - name: Indicate role in motd
diff --git a/roles/mtail/templates/mtail/radiusd.mtail.j2 b/roles/mtail/templates/mtail/radiusd.mtail.j2
new file mode 100644
index 00000000..c8fe6a81
--- /dev/null
+++ b/roles/mtail/templates/mtail/radiusd.mtail.j2
@@ -0,0 +1,47 @@
+{{ ansible_header | comment }}
+# radiusd template by erdnaxe@crans.org
+
+# Define the exported metric names.  The `by' keyword indicates the metric has
+# dimensions.  For example, `request_total' counts the frequency of each
+# request's "command".  The name `command' will be exported as the label name
+# for the metric.  The command provided in the code below will be exported as
+# the label value.
+counter radiusd_access_ok
+counter radiusd_access_refused by reason
+
+# The `syslog' decorator defines a procedure.  When a block of mtail code is
+# "decorated", it is called before entering the block.  The block is entered
+# when the keyword `next' is reached.
+def syslog {
+  /^(?P<date>(?P<legacy_date>\w+\s+\d+\s+\d+:\d+:\d+)|(?P<rfc3339_date>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d+[+-]\d{2}:\d{2}))/ +
+  /\s+(?:\w+@)?(?P<hostname>[\w\.-]+)\s+(?P<application>[\w\.-]+)(?:\[(?P<pid>\d+)\])?:\s+(?P<message>.*)/ {
+    # If the legacy_date regexp matched, try this format.
+    len($legacy_date) > 0 {
+      strptime($2, "Jan _2 15:04:05")
+    }
+    # If the RFC3339 style matched, parse it this way.
+    len($rfc3339_date) > 0 {
+      strptime($rfc3339_date, "2006-01-02T15:04:05.999999999Z07:00")
+    }
+    # Call into the decorated block
+    next
+  }
+}
+
+# Define some pattern constants for reuse in the patterns below.
+const IP /\d+(\.\d+){3}/
+const MATCH_IP /(?P<ip>/ + IP + /)/
+const MATCH_NETWORK /(?P<network>\d+(\.\d+){1,3}\/\d+)/
+const MATCH_MAC /(?P<mac>([\da-f]{2}:){5}[\da-f]{2})/
+
+@syslog {
+    # Access ok!
+    /Access ok/ {
+        radiusd_access_ok++
+    }
+
+    # Bouh!
+    /Adherent non cotisant/ {
+        radiusd_access_refused["Did not pay"]++
+    }
+}