Sentinel (IRC server-monitoring bot)

[at0m]

Starting this thread to announce that I'm going to be adapting Sentinel to TF2. I need to find my copy of the latest source for it again, and may need to collect together some information about Source's TCP RCON and UDP Server Activity data streams.

For those unaware, I helped write and maintain a mIRC-script IRC bot called Sentinel that Invade-Defend still uses to monitor and administrate their TFC servers from IRC. The whole thing's EdGruberman's brainchild, but only he, MrGoodWrench, and myself really saw its source and understood how it all worked.

It takes the form of a small botnet, with individual instances parsing UDP data from several servers, pulling relevant information out of it (and sanitizing it), then posting it to IRC in a 'TV' channel containing relevant activity data (flag captures, map changes) and server chat. They also monitor for key words (like someone saying 'admin') and alert people in an administrator channel that there's a problem. Additionally, they allow admins with proper channel permissions to execute certain rcon commands from IRC (chat, warn, kick, ban, mapchange, etc). They also cross-chat to alert admins on other servers serviced by the bot and allow them to talk back and forth between servers. That last feature may take some additional work because it uses hooks from AdminMod that probably no longer exist.

Most of the centralized IRC alerts/advertisements ("x map is playing with y players! come join the fun!") and cross-server chat functionality was taken care of by a 'master' instance, which may also need to be tweaked but the core of its functionality should still work. I'll just have to rewrite/tweak the server-side end of it and we should be golden.

I'll be using this thread to track my research and progress.

I'm pretty sure the UDP data stream still exists and is now used by HLStatsX to generate its stats using a parser daemon, but can't research it from work. HeK? Kirby?

[[SiN] Merc]

Sentinel? I usually prefer Ryu or She-Hulk on my team, but if he works, more power to you.

[at0m]

I didn't pick the name, EdG did

Wiki entry for Source's RCON protocol: http://developer.valvesoftware.com/wiki/...N_Protocol

[Kirby]

I was staff in #script (When it was actually big) on GamesNET/GameSurge, I think I might be able to lend a hand here.  8)


Depending on the implementation and if you knew how to redo this idea with an eggdrop, I could run it on my box for pretty much permanent functioning. Plus it would have a cool-ass @kirby420.com hostmask.

I'm pretty sure the UDP data stream still exists and is now used by HLStatsX to generate its stats using a parser daemon, but can't research it from work. HeK? Kirby?

HLStatsX uses the logaddress function to pull the console log realtime, I'm assuming this is what you're referring to?

[at0m]

I was staff in #script (When it was actually big) on GamesNET/GameSurge, I think I might be able to lend a hand here.  8)

Excellent.

Depending on the implementation and if you knew how to redo this idea with an eggdrop, I could run it on my box for pretty much permanent functioning. Plus it would have a cool-ass @kirby420.com hostmask.

That would be pretty close to ideal. It's a standalone set of scripts, and uses channel modes in the TV channels (voice, op) to determine who is capable of doing what actions, but integrating it into an eggdrop may be problematic since the scripts I'm talking about are written directly in mIRC's scripting 'language'. The whole net currently runs on someone else's dedicated server box (that also chews on the IRC logfiles to generate chat stats), although we had to get an exemption from GameSurge's flooding, multiple connection, and botnet policies for it. I have some experience with explaining that, so it shouldn't be a problem. We're also only managing 3 (4?) servers, which means we should only need 2 bot instances instead of 5 like we used to use at Invade-Defend.

[quote author=at0m link=topic=5740.msg212240#msg212240 date=1309185983]
I'm pretty sure the UDP data stream still exists and is now used by HLStatsX to generate its stats using a parser daemon, but can't research it from work. HeK? Kirby?

HLStatsX uses the logaddress function to pull the console log realtime, I'm assuming this is what you're referring to?
[/quote]I believe it is, although I also don't recall whether you can stream with LogAddress to more than one IP. If not, though, it's trivial to have the bot forward the traffic, and I'm pretty sure if that's the case it already does, because we used HLStats over there as well.

[Kirby]

but integrating it into an eggdrop may be problematic since the scripts I'm talking about are written directly in mIRC's scripting 'language'.

Believe me, I know that beast.

I believe it is, although I also don't recall whether you can stream with LogAddress to more than one IP.

As for the top limit on how many addresses it supports, I do not know, but I do know it supports more than one. Caff, HeK and myself can do a test at some point and see if it supports at least 4 addresses.

Code:

* ^FBI_Agent^ (~fbagent@GameSurge.user.gamesnet) Quit (G-lined (bad choice of account name))
* @Psycho (~Joe-Pa@eliwitt.user.gamesnet) Quit (G-lined (bad choice of account name))

The IRC nerds will figure out exactly why this is sort of hilarious.



Also:

Code:

Psycho (SysOp@13,6is.working.it.like.a.working.girl)
Psycho (SysOp@14,15osama.bin.llama)
Psycho (SysOp@8,9HAE.EVERYBODY.LOOK.AT.MY.FAKEHOST)
Psycho (SysOp@8,13I.LIEK.GAY.PORNO)
Psycho (SysOp@8,13I.LIEK.GAY.PORNO.PM.ME.FOR.CYBERSEX)
Psycho (SysOp@8,13omg.pm.me.now.for.a.free.ipod)
Psycho (SysOp@8,12the.first.person.to.pm.me.gets.5.dollars.via.payal)
Psycho (SysOp@13,12i.am.looking.for.a.cyber.lover)
Psycho (SysOp@0,13i.love.tunkeymicket)
Psycho (SysOp@0,13i.would.go.gay.for.tunkeymicket)
Psycho (SysOp@0,4MY.4,0INTERTNETS.0,14are.0,4BROKEN)
Psycho (SysOp@5,7you.too.can.be.a.millionare.pm.me.to.find.out.how)
Psycho (SysOp@13,6i.can.hack.gamesurge.pm.me.for.an.oline)
Psycho (SysOp@13,6i.hacked.your.mom.last.night)
Psycho (SysOp@13,6i.am.pregnant.with.beefs.baby)
Psycho (SysOp@13i.am.pregnant.with.beefs.baby)
Psycho (SysOp@13i.will.pay.1.dollar.for.each.of.your.friends.that.pm.me)
Psycho (SysOp@I.want.Beef)

Crad and myself used to chill and shit.

[HeK]

[quote author=at0m link=topic=5740.msg212272#msg212272 date=1309200888]
[quote author=at0m link=topic=5740.msg212240#msg212240 date=1309185983]
I believe it is, although I also don't recall whether you can stream with LogAddress to more than one IP.

As for the top limit on how many addresses it supports, I do not know, but I do know it supports more than one. Caff, HeK and myself can do a test at some point and see if it supports at least 4 addresses.

[/quote][/quote]

I am unsure if there is an actual limit, however with the detailed logged enabled, it chews up a surprising amount of bandwidth just streaming to the HLStatsx server.
We may be better off making changes to the HLStats daemon script.

[at0m]

[quote author=Kirby, the FaNspyPyro link=topic=5740.msg212285#msg212285 date=1309207007]
[quote author=at0m link=topic=5740.msg212272#msg212272 date=1309200888]
[quote author=at0m link=topic=5740.msg212240#msg212240 date=1309185983]
I believe it is, although I also don't recall whether you can stream with LogAddress to more than one IP.

As for the top limit on how many addresses it supports, I do not know, but I do know it supports more than one. Caff, HeK and myself can do a test at some point and see if it supports at least 4 addresses.

[/quote]

I am unsure if there is an actual limit, however with the detailed logged enabled, it chews up a surprising amount of bandwidth just streaming to the HLStatsx server.[/quote]
We may be better off making changes to the HLStats daemon script.[/quote]
That may be true for notifications (esp if you just want to use Jabber messages or something), but its tough to beat the ability to remotely kick or ban someone without having to open HLSW or TF2...

[Kirby]

OMG BUTCHERED DA QUOTE.


Also I dug up the old CS:S mIRC scorebot I helped make, so I have a working (At least of around '04) rcon logaddress example.


We could submit a ticket and see what NFO says about the outgoing bandwidth usage, do you have actual numbers HeK? I'm curious now.


Unrelated:

Code:

var %kg.tbl = 11:6:17:12:12:14:5:12:16:10:11:6:14:14:4:11:9:12:11:10:8:10:10:16:8:4:6:10:12:16:8:10:4:16 , %kg.ctr = 4 , %kg.tot = $len($1-)
while (%kg.ctr <= %kg.tot) {
var %kg.1 = $calc(%kg.1 + ($asc($mid($1-,%kg.ctr,1)) * $gettok(%kg.tbl,$calc(%kg.ctr - 3),58))) , %kg.2 = $calc(%kg.2 + (($asc($mid($1-,%kg.ctr,1)) * $asc($mid($1-,$calc(%kg.ctr - 1),1))) * $gettok(%kg.tbl,$calc(%kg.ctr -3),58)))
inc %kg.ctr

8)

[HeK]

We could submit a ticket and see what NFO says about the outgoing bandwidth usage, do you have actual numbers HeK? I'm curious now.

Easier, it just shoots lines of the log over udp?
A quick look shows the largest single log file is just over 1,000 kB. The time stamps are just over 30 minutes.
So no more then 35ish kb/s?

Personally, I'd like to start my own fork of HLStatsx. Replace headshot tracking with crits.
Then we could incorporate the irc bot.

[at0m]

OMG BUTCHERED DA QUOTE.

[quote author=Kirby, the FaNspyPyro link=topic=5740.msg212290#msg212290 date=1309208001]
We could submit a ticket and see what NFO says about the outgoing bandwidth usage, do you have actual numbers HeK? I'm curious now.

Easier, it just shoots lines of the log over udp?
A quick look shows the largest single log file is just over 1,000 kB. The time stamps are just over 30 minutes.
So no more then 35ish kb/s?

Personally, I'd like to start my own fork of HLStatsx. Replace headshot tracking with crits.
Then we could incorporate the irc bot.
[/quote]I know its enough to make a single thread in mIRC work hard enough to parse all of it from no more than two servers per instance, but that's all I know.

I'm all for the HLStatsX fork, but I don't know a thing about it. I know about this, so this is what I was going to do But I'd be more than happy to help in any way I can with your HLStats experiment

[at0m]

Double post for great justice.

Found some really old copies of my AdminMod plugins (dynamic classlimits for varying serversize, a votable bot control, and a combo-pack for Invade-Defend), as well as a _really old_ version of the TFCBot code (before it was re-written and released as Sentinel). Link if you want to see.

Still searching for the actual Sentinel code, because there were a number of bugs we found over the years that were fixed in that version. Found Sentinel 0.0.1.b. Now I just need to set up mIRC and start tweaking it.