diff --git a/plaso/lib/timelib.py b/plaso/lib/timelib.py index deaec4418e..3c351be6c4 100644 --- a/plaso/lib/timelib.py +++ b/plaso/lib/timelib.py @@ -19,21 +19,6 @@ # pylint: disable=missing-type-doc,missing-return-type-doc -MONTH_DICT = { - 'jan': 1, - 'feb': 2, - 'mar': 3, - 'apr': 4, - 'may': 5, - 'jun': 6, - 'jul': 7, - 'aug': 8, - 'sep': 9, - 'oct': 10, - 'nov': 11, - 'dec': 12} - - class Timestamp(object): """Class for converting timestamps to Plaso timestamps. diff --git a/plaso/parsers/apache_access.py b/plaso/parsers/apache_access.py index b5de050d64..c6d6c2dc8a 100644 --- a/plaso/parsers/apache_access.py +++ b/plaso/parsers/apache_access.py @@ -12,7 +12,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import manager from plaso.parsers import text_parser @@ -182,7 +181,7 @@ def _GetISO8601String(self, structure): month = self._GetValueFromStructure(structure, 'month') try: - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) except AttributeError as exception: raise ValueError('unable to parse month with error: {0!s}.'.format( exception)) diff --git a/plaso/parsers/mac_appfirewall.py b/plaso/parsers/mac_appfirewall.py index 09e14d1671..1e07fe53ff 100644 --- a/plaso/parsers/mac_appfirewall.py +++ b/plaso/parsers/mac_appfirewall.py @@ -9,7 +9,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import manager from plaso.parsers import text_parser @@ -109,7 +108,7 @@ def _GetTimeElementsTuple(self, structure): # Note that dfdatetime_time_elements.TimeElements will raise ValueError # for an invalid month. - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) if month != 0 and month < self._last_month: # Gap detected between years. diff --git a/plaso/parsers/mac_securityd.py b/plaso/parsers/mac_securityd.py index b3d1b354b6..10a0fb1b1a 100644 --- a/plaso/parsers/mac_securityd.py +++ b/plaso/parsers/mac_securityd.py @@ -13,7 +13,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import manager from plaso.parsers import text_parser @@ -118,7 +117,7 @@ def _GetTimeElementsTuple(self, structure): # Note that dfdatetime_time_elements.TimeElements will raise ValueError # for an invalid month. - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) if month != 0 and month < self._last_month: # Gap detected between years. diff --git a/plaso/parsers/mac_wifi.py b/plaso/parsers/mac_wifi.py index 8a59815a3e..b20e4add06 100644 --- a/plaso/parsers/mac_wifi.py +++ b/plaso/parsers/mac_wifi.py @@ -11,7 +11,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import manager from plaso.parsers import text_parser @@ -195,7 +194,7 @@ def _GetTimeElementsTuple(self, key, structure): # Note that dfdatetime_time_elements.TimeElements will raise ValueError # for an invalid month. - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) if month != 0 and month < self._last_month: # Gap detected between years. diff --git a/plaso/parsers/syslog.py b/plaso/parsers/syslog.py index a75ad1ea30..cc99e5b751 100644 --- a/plaso/parsers/syslog.py +++ b/plaso/parsers/syslog.py @@ -15,7 +15,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import manager from plaso.parsers import text_parser @@ -321,7 +320,7 @@ def ParseRecord(self, parser_mediator, key, structure): month = self._GetValueFromStructure(structure, 'month') try: - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) except AttributeError: parser_mediator.ProduceExtractionWarning( 'invalid month value: {0!s}'.format(month)) diff --git a/plaso/parsers/text_parser.py b/plaso/parsers/text_parser.py index 8f06c1e7e9..807778718b 100644 --- a/plaso/parsers/text_parser.py +++ b/plaso/parsers/text_parser.py @@ -171,6 +171,20 @@ class PyparsingSingleLineTextParser(interface.FileObjectParser): # Allow for a maximum of 40 empty lines before we bail out. _MAXIMUM_DEPTH = 40 + _MONTH_DICT = { + 'jan': 1, + 'feb': 2, + 'mar': 3, + 'apr': 4, + 'may': 5, + 'jun': 6, + 'jul': 7, + 'aug': 8, + 'sep': 9, + 'oct': 10, + 'nov': 11, + 'dec': 12} + def __init__(self): """Initializes a parser.""" super(PyparsingSingleLineTextParser, self).__init__() diff --git a/plaso/parsers/vsftpd.py b/plaso/parsers/vsftpd.py index 8353f9af88..9a8a1aa57e 100644 --- a/plaso/parsers/vsftpd.py +++ b/plaso/parsers/vsftpd.py @@ -8,7 +8,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import text_parser from plaso.parsers import manager @@ -76,7 +75,7 @@ def _GetTimeElementsTuple(self, structure): """ time_elements_tuple = self._GetValueFromStructure(structure, 'date_time') _, month, day_of_month, hours, minutes, seconds, year = time_elements_tuple - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) return (year, month, day_of_month, hours, minutes, seconds) diff --git a/plaso/parsers/xchatlog.py b/plaso/parsers/xchatlog.py index a4f1ab6c21..20f0f0b593 100644 --- a/plaso/parsers/xchatlog.py +++ b/plaso/parsers/xchatlog.py @@ -60,7 +60,6 @@ from plaso.containers import time_events from plaso.lib import errors from plaso.lib import definitions -from plaso.lib import timelib from plaso.parsers import logger from plaso.parsers import manager from plaso.parsers import text_parser @@ -169,7 +168,7 @@ def _GetTimeElementsTuple(self, structure): # TODO: what if time_elements_tuple is None. month, day, hours, minutes, seconds = time_elements_tuple - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) if month != 0 and month < self._last_month: # Gap detected between years. @@ -190,7 +189,7 @@ def _ParseHeader(self, parser_mediator, structure): # TODO: what if time_elements_tuple is None. _, month, day, hours, minutes, seconds, year = time_elements_tuple - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) time_elements_tuple = (year, month, day, hours, minutes, seconds) @@ -323,7 +322,7 @@ def VerifyStructure(self, parser_mediator, line): time_elements_tuple)) return False - month = timelib.MONTH_DICT.get(month.lower(), 0) + month = self._MONTH_DICT.get(month.lower(), 0) time_elements_tuple = (year, month, day, hours, minutes, seconds) diff --git a/tests/lib/timelib.py b/tests/lib/timelib.py index 7fdb1fc106..7ae587409d 100644 --- a/tests/lib/timelib.py +++ b/tests/lib/timelib.py @@ -24,15 +24,6 @@ def testCopyToIsoFormat(self): timestamp, timezone=timezone) self.assertEqual(date_time_string, '2013-03-14T21:20:08.850041+01:00') - def testMonthDict(self): - """Test the month dict, both inside and outside of scope.""" - self.assertEqual(timelib.MONTH_DICT['nov'], 11) - self.assertEqual(timelib.MONTH_DICT['jan'], 1) - self.assertEqual(timelib.MONTH_DICT['may'], 5) - - month = timelib.MONTH_DICT.get('doesnotexist') - self.assertIsNone(month) - def testLocaltimeToUTC(self): """Test the localtime to UTC conversion.""" timezone = pytz.timezone('CET')