#!/usr/bin/env python3
import os
import datetime
import subprocess
import re
 
# --- CONFIGURAÇÕES ---
LOG_DIR = "/var/log"
HOSTNAME = "wanguardcliente.telic.cl"        # Host configurado no Zabbix
ZBX_KEY = "flowparser"            # Item do Zabbix que vai receber o valor
ZBX_SERVER = "2804:54c8:cafe:85::14"      # IP/hostname do servidor Zabbix
 
# --- EVENTO CUSTOMIZÁVEL ---
SEARCH_MODULE = "[Flow Parser]"
SEARCH_EVENT = "No flow received in the last"
 
# --- DATA DE HOJE (log atual) ---
today = datetime.date.today().strftime("%Y-%m-%d")
logfile = f"{LOG_DIR}/wanguard_events_{today}.log"
 
def check_event():
    """Verifica se o evento existe no log nos últimos 10 minutos e se tem segundos >= 10"""
    if not os.path.exists(logfile):
        return 1
 
    now = datetime.datetime.now()
    cutoff = now - datetime.timedelta(minutes=10)
 
    with open(logfile, "r") as f:
        for line in f:
            try:
                # Cada linha começa com "YYYY-MM-DD HH:MM:SS ..."
                parts = line.split(" ", 2)  
                timestamp_str = f"{parts[0]} {parts[1]}"
                evt_time = datetime.datetime.strptime(timestamp_str, "%Y-%m-%d %H:%M:%S")
 
                if evt_time >= cutoff and SEARCH_MODULE in line and SEARCH_EVENT in line:
                    # Extrai segundos
                    match = re.search(r"last (\d+) seconds", line)
                    if match:
                        seconds = int(match.group(1))
                        if seconds >= 10:
                            return 0
            except Exception:
                continue
    return 1
 
def send_to_zabbix(value):
    """Envia trap para o Zabbix"""
    cmd = [
        "zabbix_sender",
        "-z", ZBX_SERVER,
        "-s", HOSTNAME,
        "-k", ZBX_KEY,
        "-o", str(value)
    ]
    try:
        subprocess.run(cmd, check=True, capture_output=True)
        print(f"[OK] Enviado para Zabbix: {HOSTNAME} {ZBX_KEY} = {value}")
    except subprocess.CalledProcessError as e:
        print(f"[ERRO] Falha ao enviar para o Zabbix: {e.stderr.decode()}")
 
if __name__ == "__main__":
    result = check_event()
    send_to_zabbix(result)