Struct LogcheckDatabase 

pub struct LogcheckDatabase {
    pub cracking_rules: RuleSet,
    pub cracking_ignore: RuleSet,
    pub violations_rules: RuleSet,
    pub violations_ignore: RuleSet,
    pub system_events: RuleSet,
    pub workstation: RuleSet,
    pub server: RuleSet,
    pub local: RuleSet,
}

Fields

cracking_rules: RuleSet

cracking_ignore: RuleSet

violations_rules: RuleSet

violations_ignore: RuleSet

system_events: RuleSet

workstation: RuleSet

server: RuleSet

local: RuleSet

Implementations

impl LogcheckDatabase

pub fn new() -> Self

Create a new empty logcheck database

fn convert_posix_classes(pattern: &str) -> String

Convert POSIX character classes to Rust regex equivalents Logcheck rules use POSIX classes like [[:alnum:]], [[:digit:]], etc. which are not supported by Rust’s regex crate

This now uses the centralized regex_conversion module

pub fn load_from_directory<P: AsRef<Path>>( base_path: P, ) -> Result<Self, RuleError>

Load logcheck database from traditional directory structure

fn load_rule_directory( dir_path: &Path, rule_set: &mut RuleSet, ) -> Result<(), RuleError>

Load all rule files from a directory

fn load_rule_file( file_path: &Path, rule_set: &mut RuleSet, ) -> Result<(), RuleError>

Load a single rule file

pub fn compile_all(&mut self) -> Result<(), RuleError>

Compile all rule sets for efficient matching

pub fn match_message(&self, message: &str) -> Option<RuleCategory>

Match a log message against logcheck rules Returns the rule category if matched, following logcheck precedence

pub fn get_stats(&self) -> HashMap<String, usize>

Get statistics about loaded rules

Trait Implementations

impl Clone for LogcheckDatabase

fn clone(&self) -> LogcheckDatabase

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LogcheckDatabase

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LogcheckDatabase

fn default() -> Self

Returns the “default value” for a type.