Updating tests for the #start/#end change.

This commit is contained in:
Robin Sommer 2012-07-19 18:57:15 -07:00
parent 87e10b5f97
commit 5cfb8d65c3
123 changed files with 442 additions and 162 deletions

@ -1 +1 @@
Subproject commit b4094cb75e0a7769123f7db1f5d73f3f9f1c3977 Subproject commit 4ad8d15b6395925c9875c9d2912a6cc3b4918e0a

@ -1 +1 @@
Subproject commit 2038e3de042115c3caa706426e16c830c1fd1e9e Subproject commit c691c01e9cefae5a79bcd4b0f84ca387c8c587a7

@ -1 +1 @@
Subproject commit 07866915a1450ddd25b888917f494b4824b0cc3f Subproject commit 8234b8903cbc775f341bdb6a1c0159981d88d27b

@ -1 +1 @@
Subproject commit 892b60edb967bb456872638f22ba994e84530137 Subproject commit d5ecd1a42c04b0dca332edc31811e5a6d0f7f2fb

2
cmake

@ -1 +1 @@
Subproject commit 96f3d92acadbe1ae64f410e974c5ff503903394b Subproject commit 2a72c5e08e018cf632033af3920432d5f684e130

View file

@ -2,6 +2,7 @@
#include <string> #include <string>
#include <errno.h> #include <errno.h>
#include <fcntl.h>
#include "NetVar.h" #include "NetVar.h"
#include "threading/SerialTypes.h" #include "threading/SerialTypes.h"

View file

@ -93,9 +93,11 @@ const char* BasicThread::Fmt(const char* format, ...)
const char* BasicThread::Strerror(int err) const char* BasicThread::Strerror(int err)
{ {
static char buf[128] = "<not set>"; if ( ! strerr_buffer )
strerror_r(err, buf, sizeof(buf)); strerr_buffer = new char[256];
return buf;
strerror_r(err, strerr_buffer, 256);
return strerr_buffer;
} }
void BasicThread::Start() void BasicThread::Start()

View file

@ -120,8 +120,8 @@ public:
/** /**
* A version of strerror() that the thread can safely use. This is * A version of strerror() that the thread can safely use. This is
* essentially a wrapper around strerror_r(). Note that it keeps a * essentially a wrapper around strerror_r(). Note that it keeps a
* single static buffer internally so the result remains valid only * single buffer per thread internally so the result remains valid
* until the next call. * only until the next call.
*/ */
const char* Strerror(int err); const char* Strerror(int err);
@ -207,6 +207,9 @@ private:
char* buf; char* buf;
unsigned int buf_len; unsigned int buf_len;
// For implementating Strerror().
char* strerr_buffer;
static uint64_t thread_counter; static uint64_t thread_counter;
}; };

View file

@ -5,6 +5,7 @@
#include "Manager.h" #include "Manager.h"
#include <unistd.h> #include <unistd.h>
#include <signal.h>
using namespace threading; using namespace threading;

View file

@ -3,4 +3,4 @@
-60.0 -60.0
3600.0 3600.0
86400.0 86400.0
1337982322.762159 1342748947.655087

View file

@ -3,81 +3,101 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-03-01
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332784981.078396 - - - - - bad_IP_checksum - F bro 1332784981.078396 - - - - - bad_IP_checksum - F bro
#end 2012-03-26-18-03-01
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-01-25
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332784885.686428 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 80 bad_TCP_checksum - F bro 1332784885.686428 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 80 bad_TCP_checksum - F bro
#end 2012-03-26-18-01-25
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-02-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332784933.501023 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 13000 bad_UDP_checksum - F bro 1332784933.501023 UWkUyAuUGXf 127.0.0.1 30000 127.0.0.1 13000 bad_UDP_checksum - F bro
#end 2012-03-26-18-02-13
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-29-23
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075363.536871 UWkUyAuUGXf 192.168.1.100 8 192.168.1.101 0 bad_ICMP_checksum - F bro 1334075363.536871 UWkUyAuUGXf 192.168.1.100 8 192.168.1.101 0 bad_ICMP_checksum - F bro
#end 2012-04-10-16-29-23
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-06-50
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332785210.013051 - - - - - routing0_hdr - F bro 1332785210.013051 - - - - - routing0_hdr - F bro
1332785210.013051 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 80 bad_TCP_checksum - F bro 1332785210.013051 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 80 bad_TCP_checksum - F bro
#end 2012-03-26-18-06-50
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-17-23-00
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332782580.798420 - - - - - routing0_hdr - F bro 1332782580.798420 - - - - - routing0_hdr - F bro
1332782580.798420 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 13000 bad_UDP_checksum - F bro 1332782580.798420 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:78:1:32::2 13000 bad_UDP_checksum - F bro
#end 2012-03-26-17-23-00
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-25-11
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075111.800086 - - - - - routing0_hdr - F bro 1334075111.800086 - - - - - routing0_hdr - F bro
1334075111.800086 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:78:1:32::1 129 bad_ICMP_checksum - F bro 1334075111.800086 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:78:1:32::1 129 bad_ICMP_checksum - F bro
#end 2012-04-10-16-25-11
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-07-30
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332785250.469132 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 80 bad_TCP_checksum - F bro 1332785250.469132 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 80 bad_TCP_checksum - F bro
#end 2012-03-26-18-07-30
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-17-02-22
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332781342.923813 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 13000 bad_UDP_checksum - F bro 1332781342.923813 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 30000 2001:4f8:4:7:2e0:81ff:fe52:9a6b 13000 bad_UDP_checksum - F bro
#end 2012-03-26-17-02-22
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-22-19
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro 1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
#end 2012-04-10-16-22-19

View file

@ -3,54 +3,68 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-22-19
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro 1334074939.467194 UWkUyAuUGXf 2001:4f8:4:7:2e0:81ff:fe52:ffff 128 2001:4f8:4:7:2e0:81ff:fe52:9a6b 129 bad_ICMP_checksum - F bro
#end 2012-04-10-16-22-19
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-18-05-25
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332785125.596793 - - - - - routing0_hdr - F bro 1332785125.596793 - - - - - routing0_hdr - F bro
#end 2012-03-26-18-05-25
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-03-26-17-21-48
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1332782508.592037 - - - - - routing0_hdr - F bro 1332782508.592037 - - - - - routing0_hdr - F bro
#end 2012-03-26-17-21-48
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-23-47
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075027.053380 - - - - - routing0_hdr - F bro 1334075027.053380 - - - - - routing0_hdr - F bro
#end 2012-04-10-16-23-47
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-23-47
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075027.053380 - - - - - routing0_hdr - F bro 1334075027.053380 - - - - - routing0_hdr - F bro
#end 2012-04-10-16-23-47
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-23-47
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075027.053380 - - - - - routing0_hdr - F bro 1334075027.053380 - - - - - routing0_hdr - F bro
#end 2012-04-10-16-23-47
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-16-23-47
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334075027.053380 - - - - - routing0_hdr - F bro 1334075027.053380 - - - - - routing0_hdr - F bro
#end 2012-04-10-16-23-47

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-05-21-56-51
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1333663011.602839 - - - - - unknown_protocol_135 - F bro 1333663011.602839 - - - - - unknown_protocol_135 - F bro
#end 2012-04-05-21-56-51

View file

@ -3,14 +3,16 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path reporter #path reporter
#start 2011-03-18-19-06-08
#fields ts level message location #fields ts level message location
#types time enum string string #types time enum string string
1300475168.783842 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.783842 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.915940 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.915940 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.916118 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.916118 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.918295 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.918295 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.952193 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.952193 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.952228 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.952228 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.954761 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.954761 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475168.962628 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475168.962628 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
1300475169.780331 Reporter::ERROR field value missing [c$ftp] /home/jsiwek/bro/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10 1300475169.780331 Reporter::ERROR field value missing [c$ftp] /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.bro, line 10
#end 2011-03-18-19-06-13

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path dns #path dns
#start 2012-03-07-01-37-58
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs
#types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval] #types time string addr port addr port enum count string count string count string count string bool bool bool bool count vector[string] vector[interval]
1331084278.438444 UWkUyAuUGXf 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51850 2607:f740:b::f93 53 udp 3903 txtpadding_323.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000 1331084278.438444 UWkUyAuUGXf 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51850 2607:f740:b::f93 53 udp 3903 txtpadding_323.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
1331084293.592245 arKYeMETxOg 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51851 2607:f740:b::f93 53 udp 40849 txtpadding_3230.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000 1331084293.592245 arKYeMETxOg 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51851 2607:f740:b::f93 53 udp 40849 txtpadding_3230.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR T F T F 0 This TXT record should be ignored 1.000000
#end 2012-03-07-01-38-18

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2005-10-07-23-23-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty) 1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
#end 2005-10-07-23-23-57

View file

@ -3,30 +3,38 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path packet_filter #path packet_filter
#start 1970-01-01-00-00-00
#fields ts node filter init success #fields ts node filter init success
#types time string string bool bool #types time string string bool bool
1340229717.179155 - ip or not ip T T 1342748953.570646 - ip or not ip T T
#end <abnormal termination>
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path packet_filter #path packet_filter
#start 1970-01-01-00-00-00
#fields ts node filter init success #fields ts node filter init success
#types time string string bool bool #types time string string bool bool
1340229717.462355 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T 1342748953.898675 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
#end <abnormal termination>
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path packet_filter #path packet_filter
#start 1970-01-01-00-00-00
#fields ts node filter init success #fields ts node filter init success
#types time string string bool bool #types time string string bool bool
1340229717.733007 - port 42 T T 1342748954.278211 - port 42 T T
#end <abnormal termination>
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path packet_filter #path packet_filter
#start 1970-01-01-00-00-00
#fields ts node filter init success #fields ts node filter init success
#types time string string bool bool #types time string string bool bool
1340229718.001009 - port 56730 T T 1342748954.883780 - port 56730 T T
#end 2005-10-07-23-23-57

View file

@ -1,2 +1,2 @@
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.bro, line 22: no such index (a[2]) error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.bro, line 22: no such index (a[2])
1st error printed on script level 1st error printed on script level

View file

@ -1 +1 @@
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-fmt-strings/reporter-fmt-strings.bro, line 9: not an event (dont_interpret_this(%s)) error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-fmt-strings/reporter-fmt-strings.bro, line 9: not an event (dont_interpret_this(%s))

View file

@ -1 +1 @@
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-parse-error/reporter-parse-error.bro, line 7: unknown identifier TESTFAILURE, at or near "TESTFAILURE" error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-parse-error/reporter-parse-error.bro, line 7: unknown identifier TESTFAILURE, at or near "TESTFAILURE"

View file

@ -1 +1 @@
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-runtime-error/reporter-runtime-error.bro, line 12: no such index (a[1]) error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-runtime-error/reporter-runtime-error.bro, line 12: no such index (a[1])

View file

@ -1,3 +1,3 @@
error in string and /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: arithmetic mixed with non-arithmetic (string and 42) error in string and /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: arithmetic mixed with non-arithmetic (string and 42)
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11 and string: type mismatch (42 and string) error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11 and string: type mismatch (42 and string)
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: argument type mismatch in event invocation (foo(42)) error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter-type-mismatch/reporter-type-mismatch.bro, line 11: argument type mismatch in event invocation (foo(42))

View file

@ -1,6 +1,6 @@
reporter_info|init test-info|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 8|0.000000 reporter_info|init test-info|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 8|0.000000
reporter_warning|init test-warning|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 9|0.000000 reporter_warning|init test-warning|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 9|0.000000
reporter_error|init test-error|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 10|0.000000 reporter_error|init test-error|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 10|0.000000
reporter_info|done test-info|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 15|0.000000 reporter_info|done test-info|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 15|0.000000
reporter_warning|done test-warning|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 16|0.000000 reporter_warning|done test-warning|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 16|0.000000
reporter_error|done test-error|/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 17|0.000000 reporter_error|done test-error|/da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 17|0.000000

View file

@ -1,3 +1,3 @@
/Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 52: pre test-info /da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 52: pre test-info
warning in /Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 53: pre test-warning warning in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 53: pre test-warning
error in /Users/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 54: pre test-error error in /da/home/robin/bro/master/testing/btest/.tmp/core.reporter/reporter.bro, line 54: pre test-error

View file

@ -3,30 +3,38 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-11-16-01-35
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334160095.895421 - - - - - truncated_IP - F bro 1334160095.895421 - - - - - truncated_IP - F bro
#end 2012-04-11-16-01-35
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-11-14-57-21
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334156241.519125 - - - - - truncated_IP - F bro 1334156241.519125 - - - - - truncated_IP - F bro
#end 2012-04-11-14-57-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-04-10-21-50-48
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1334094648.590126 - - - - - truncated_IP - F bro 1334094648.590126 - - - - - truncated_IP - F bro
#end 2012-04-10-21-50-48
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-05-29-22-02-34
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1338328954.078361 - - - - - internally_truncated_header - F bro 1338328954.078361 - - - - - internally_truncated_header - F bro
#end 2012-05-29-22-02-34

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2009-11-08-04-41-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1257655301.595604 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - 0 ShADad 10 3605 11 5329 k6kgXLOoSKl 1257655301.595604 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - 0 ShADad 10 3605 11 5329 k6kgXLOoSKl
@ -13,3 +14,4 @@
1257655296.585188 TEfuqmmG4bh fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl 1257655296.585188 TEfuqmmG4bh fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
1257655296.585151 j4u32Pc5bif fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl 1257655296.585151 j4u32Pc5bif fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
1257655296.585034 nQcgTWjvg4c fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl 1257655296.585034 nQcgTWjvg4c fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - 0 - 2 144 0 0 k6kgXLOoSKl
#end 2009-11-08-04-41-57

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2009-11-08-04-41-41
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1257655301.652206 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - text/html - - 1257655301.652206 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 10102 200 OK - - - (empty) - - - text/html - -
1257655302.514424 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - 1257655302.514424 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 2 GET ipv6.google.com /csi?v=3&s=webhp&action=&tran=undefined&e=17259,19771,21517,21766,21887,22212&ei=BUz2Su7PMJTglQfz3NzCAw&rt=prt.77,xjs.565,ol.645 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
1257655303.603569 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - - 1257655303.603569 5OKnoww6xl4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 3 GET ipv6.google.com /gen_204?atyp=i&ct=fade&cad=1254&ei=BUz2Su7PMJTglQfz3NzCAw&zx=1257655303600 http://ipv6.google.com/ Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.15pre) Gecko/2009091516 Camino/2.0b4 (like Firefox/3.0.15pre) 0 0 204 No Content - - - (empty) - - - - - -
#end 2009-11-08-04-41-57

View file

@ -3,9 +3,11 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path tunnel #path tunnel
#start 2009-11-08-04-41-33
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum #types time string addr port addr port enum enum
1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER 1257655293.629048 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER 1257655296.585034 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::DISCOVER
1257655317.464035 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE 1257655317.464035 k6kgXLOoSKl 192.168.3.101 53859 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
1257655317.464035 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE 1257655317.464035 UWkUyAuUGXf 192.168.3.101 53796 216.14.98.22 5072 Tunnel::AYIYA Tunnel::CLOSE
#end 2009-11-08-04-41-57

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path dpd #path dpd
#start 2009-11-18-17-59-51
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto analyzer failure_reason
#types time string addr port addr port enum string string #types time string addr port addr port enum string string
1258567191.486869 UWkUyAuUGXf 192.168.1.105 57696 192.168.1.1 53 udp TEREDO Teredo payload length [c\x1d\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x04amch\x0equestionmarket\x03com\x00\x00\x01\x00...] 1258567191.486869 UWkUyAuUGXf 192.168.1.105 57696 192.168.1.1 53 udp TEREDO Teredo payload length [c\x1d\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x04amch\x0equestionmarket\x03com\x00\x00\x01\x00...]
@ -11,3 +12,4 @@
1258581768.898165 TEfuqmmG4bh 192.168.1.104 50798 192.168.1.1 53 udp TEREDO Teredo payload length [o\xe3\x81\x80\x00\x01\x00\x02\x00\x04\x00\x04\x03www\x0fnashuatelegraph\x03com\x00\x00\x01\x00...] 1258581768.898165 TEfuqmmG4bh 192.168.1.104 50798 192.168.1.1 53 udp TEREDO Teredo payload length [o\xe3\x81\x80\x00\x01\x00\x02\x00\x04\x00\x04\x03www\x0fnashuatelegraph\x03com\x00\x00\x01\x00...]
1258584478.989528 FrJExwHcSal 192.168.1.104 64963 192.168.1.1 53 udp TEREDO Teredo payload length [e\xbd\x81\x80\x00\x01\x00\x08\x00\x06\x00\x06\x08wellness\x05blogs\x04time\x03com\x00\x00\x01\x00...] 1258584478.989528 FrJExwHcSal 192.168.1.104 64963 192.168.1.1 53 udp TEREDO Teredo payload length [e\xbd\x81\x80\x00\x01\x00\x08\x00\x06\x00\x06\x08wellness\x05blogs\x04time\x03com\x00\x00\x01\x00...]
1258600683.934672 5OKnoww6xl4 192.168.1.103 59838 192.168.1.1 53 udp TEREDO Teredo payload length [h\xf0\x81\x80\x00\x01\x00\x01\x00\x02\x00\x00\x06update\x0csanasecurity\x03com\x00\x00\x01\x00...] 1258600683.934672 5OKnoww6xl4 192.168.1.103 59838 192.168.1.1 53 udp TEREDO Teredo payload length [h\xf0\x81\x80\x00\x01\x00\x01\x00\x02\x00\x00\x06update\x0csanasecurity\x03com\x00\x00\x01\x00...]
#end 2009-11-19-03-18-03

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2009-11-18-17-59-51
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1258567191.405770 - - - - - truncated_header_in_tunnel - F bro 1258567191.405770 - - - - - truncated_header_in_tunnel - F bro
@ -11,3 +12,4 @@
1258581768.568451 - - - - - truncated_header_in_tunnel - F bro 1258581768.568451 - - - - - truncated_header_in_tunnel - F bro
1258584478.859853 - - - - - truncated_header_in_tunnel - F bro 1258584478.859853 - - - - - truncated_header_in_tunnel - F bro
1258600683.934458 - - - - - truncated_header_in_tunnel - F bro 1258600683.934458 - - - - - truncated_header_in_tunnel - F bro
#end 2009-11-19-03-18-03

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2008-05-16-15-50-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1210953047.736921 arKYeMETxOg 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - 0 fA 1 40 1 40 (empty) 1210953047.736921 arKYeMETxOg 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - 0 fA 1 40 1 40 (empty)
@ -26,3 +27,4 @@
1210953052.324629 FrJExwHcSal fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 TEfuqmmG4bh 1210953052.324629 FrJExwHcSal fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 TEfuqmmG4bh
1210953060.829303 qCaWGmzFtM5 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - 0 - 1 52 1 52 GSxOnSLghOa,nQcgTWjvg4c 1210953060.829303 qCaWGmzFtM5 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - 0 - 1 52 1 52 GSxOnSLghOa,nQcgTWjvg4c
1210953052.202579 j4u32Pc5bif fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 nQcgTWjvg4c 1210953052.202579 j4u32Pc5bif fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 nQcgTWjvg4c
#end 2008-05-16-15-51-16

View file

@ -3,9 +3,11 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2008-05-16-15-50-58
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1210953057.917183 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - text/plain - - 1210953057.917183 3PKsZ2Uye21 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - Syncer/4.80 (av_pro-1169;f) 589 0 204 <empty> - - - (empty) - - - text/plain - -
1210953061.585996 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - - 1210953061.585996 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
1210953073.381474 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - - 1210953073.381474 70MGiRM1Qf4 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
1210953074.674817 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - text/xml - - 1210953074.674817 c4Zw9TmAE05 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - text/xml - -
#end 2008-05-16-15-51-16

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path tunnel #path tunnel
#start 2008-05-16-15-50-52
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum #types time string addr port addr port enum enum
1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER 1210953052.202579 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
@ -11,3 +12,4 @@
1210953076.058333 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE 1210953076.058333 nQcgTWjvg4c 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
1210953076.058333 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE 1210953076.058333 GSxOnSLghOa 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
1210953076.058333 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE 1210953076.058333 TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
#end 2008-05-16-15-51-16

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2012-06-19-17-39-37
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1340127577.354166 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - 0 ShADad 10 2279 12 11191 j4u32Pc5bif 1340127577.354166 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - 0 ShADad 10 2279 12 11191 j4u32Pc5bif
@ -12,3 +13,4 @@
1340127577.339015 nQcgTWjvg4c fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 k6kgXLOoSKl 1340127577.339015 nQcgTWjvg4c fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - 0 - 1 88 0 0 k6kgXLOoSKl
1340127577.343969 TEfuqmmG4bh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - 0 - 1 52 1 52 UWkUyAuUGXf,j4u32Pc5bif 1340127577.343969 TEfuqmmG4bh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - 0 - 1 52 1 52 UWkUyAuUGXf,j4u32Pc5bif
1340127577.336558 arKYeMETxOg fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 UWkUyAuUGXf 1340127577.336558 arKYeMETxOg fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - 0 - 1 64 0 0 UWkUyAuUGXf
#end 2012-06-19-17-39-37

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2012-06-19-17-39-37
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1340127577.361683 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - - 1340127577.361683 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - text/html - -
1340127577.379360 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - - 1340127577.379360 FrJExwHcSal 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - text/html - -
#end 2012-06-19-17-39-37

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path tunnel #path tunnel
#start 2012-06-19-17-39-37
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum #types time string addr port addr port enum enum
1340127577.336558 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER 1340127577.336558 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
@ -11,3 +12,4 @@
1340127577.406995 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE 1340127577.406995 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
1340127577.406995 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE 1340127577.406995 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
1340127577.406995 k6kgXLOoSKl 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE 1340127577.406995 k6kgXLOoSKl 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
#end 2012-06-19-17-39-37

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path weird #path weird
#start 2012-06-19-17-39-37
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string #types time string addr port addr port string string bool string
1340127577.346849 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro 1340127577.346849 UWkUyAuUGXf 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro
1340127577.349292 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro 1340127577.349292 j4u32Pc5bif 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro
#end 2012-06-19-17-39-37

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2005-10-07-23-23-55
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH - 0 SADF 11 470 0 0 (empty) 952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH - 0 SADF 11 470 0 0 (empty)
1128727435.450898 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty) 1128727435.450898 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 730 10 9945 (empty)
1278600802.069419 k6kgXLOoSKl 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 381 7 3801 (empty) 1278600802.069419 k6kgXLOoSKl 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 381 7 3801 (empty)
#end 2010-07-08-14-53-22

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path loaded_scripts #path loaded_scripts
#start 2012-07-20-01-49-31
#fields name #fields name
#types string #types string
scripts/base/init-bare.bro scripts/base/init-bare.bro
@ -28,3 +29,4 @@ scripts/base/init-bare.bro
scripts/base/frameworks/input/./readers/raw.bro scripts/base/frameworks/input/./readers/raw.bro
scripts/base/frameworks/input/./readers/benchmark.bro scripts/base/frameworks/input/./readers/benchmark.bro
scripts/policy/misc/loaded-scripts.bro scripts/policy/misc/loaded-scripts.bro
#end 2012-07-20-01-49-31

View file

@ -1,5 +1,5 @@
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 13 print cover me; 1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 13 print cover me;
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 17 print always executed; 1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 17 print always executed;
0 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 26 print also impossible, but included in code coverage analysis; 0 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 26 print also impossible, but included in code coverage analysis;
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 29 print success; 1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 29 print success;
1 /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 5 print first; 1 /da/home/robin/bro/master/testing/btest/.tmp/coverage.coverage-blacklist/coverage-blacklist.bro, line 5 print first;

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path loaded_scripts #path loaded_scripts
#start 2012-07-20-01-49-33
#fields name #fields name
#types string #types string
scripts/base/init-bare.bro scripts/base/init-bare.bro
@ -108,3 +109,4 @@ scripts/base/init-default.bro
scripts/base/protocols/syslog/./consts.bro scripts/base/protocols/syslog/./consts.bro
scripts/base/protocols/syslog/./main.bro scripts/base/protocols/syslog/./main.bro
scripts/policy/misc/loaded-scripts.bro scripts/policy/misc/loaded-scripts.bro
#end 2012-07-20-01-49-33

View file

@ -1,3 +1,3 @@
ping received, seq 0, 1324314397.698781 at src, 1324314397.699240 at dest, ping received, seq 0, 1342749173.594568 at src, 1342749173.637317 at dest,
ping received, seq 1, 1324314398.698905 at src, 1324314398.699094 at dest, ping received, seq 1, 1342749174.594948 at src, 1342749174.596551 at dest,
ping received, seq 2, 1324314399.699012 at src, 1324314399.699231 at dest, ping received, seq 2, 1342749175.595486 at src, 1342749175.596581 at dest,

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2012-07-20-01-53-03
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1336588614.060989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - - 1342749182.906082 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
#end 2012-07-20-01-53-04

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2012-07-20-01-53-03
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1336588614.060989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - - 1342749182.906082 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
#end 2012-07-20-01-53-04

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2012-07-20-01-53-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1336587178.164598 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - - 1342749191.765740 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
#end 2012-07-20-01-53-13

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2012-07-20-01-53-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1336587178.164598 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - - 1342749191.765740 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - -
#end 2012-07-20-01-53-13

View file

@ -1,7 +1,7 @@
==== atomic ==== atomic
-10 -10
2 2
1336411585.166009 1342749196.619505
2.0 mins 2.0 mins
F F
1.5 1.5

View file

@ -1,7 +1,7 @@
==== atomic a 1 ==== ==== atomic a 1 ====
-4L -4 -4L -4
42 42 42 42
1336411585.1711 1342749196.6624
60.0 60.0
True True True True
3.14 3.14
@ -14,7 +14,7 @@ True True
==== atomic a 2 ==== ==== atomic a 2 ====
-10L -10 -10L -10
2 2 2 2
1336411585.1660 1342749196.6195
120.0 120.0
False False False False
1.5 1.5
@ -27,7 +27,7 @@ False False
==== atomic b 2 ==== ==== atomic b 2 ====
-10L -10 -10L -10
<broccoli.count instance at > 2 <broccoli.count instance at > 2
<broccoli.time instance at > 1336411585.1660 <broccoli.time instance at > 1342749196.6195
<broccoli.interval instance at > 120.0 <broccoli.interval instance at > 120.0
False False False False
1.5 1.5

View file

@ -1 +1 @@
error in /Users/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10: illegal delete statement (delete x$a) error in /da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10: illegal delete statement (delete x$a)

View file

@ -3,20 +3,22 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path communication #path communication
#start 2012-07-20-01-49-40
#fields ts peer src_name connected_peer_desc connected_peer_addr connected_peer_port level message #fields ts peer src_name connected_peer_desc connected_peer_addr connected_peer_port level message
#types time string string string addr port string string #types time string string string addr port string string
1340904724.781527 bro parent - - - info [#1/127.0.0.1:47757] added peer 1342748980.737451 bro parent - - - info [#1/127.0.0.1:47757] added peer
1340904724.784954 bro child - - - info [#1/127.0.0.1:47757] connected 1342748980.747149 bro child - - - info [#1/127.0.0.1:47757] connected
1340904724.786168 bro parent - - - info [#1/127.0.0.1:47757] peer connected 1342748980.748489 bro parent - - - info [#1/127.0.0.1:47757] peer connected
1340904724.786168 bro parent - - - info [#1/127.0.0.1:47757] phase: version 1342748980.748489 bro parent - - - info [#1/127.0.0.1:47757] phase: version
1340904724.786168 bro script - - - info connection established 1342748980.750749 bro script - - - info connection established
1340904724.786168 bro script - - - info requesting events matching /^?(NOTHING)$?/ 1342748980.750749 bro script - - - info requesting events matching /^?(NOTHING)$?/
1340904724.786168 bro script - - - info accepting state 1342748980.750749 bro script - - - info accepting state
1340904724.787645 bro parent - - - info [#1/127.0.0.1:47757] phase: handshake 1342748980.752225 bro parent - - - info [#1/127.0.0.1:47757] phase: handshake
1340904724.787645 bro parent - - - info warning: no events to request 1342748980.752225 bro parent - - - info warning: no events to request
1340904724.788857 bro parent - - - info [#1/127.0.0.1:47757] peer_description is bro 1342748980.753384 bro parent - - - info [#1/127.0.0.1:47757] peer_description is bro
1340904724.829480 bro parent - - - info [#1/127.0.0.1:47757] peer supports keep-in-cache; using that 1342748980.793108 bro parent - - - info [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
1340904724.829480 bro parent - - - info [#1/127.0.0.1:47757] phase: running 1342748980.793108 bro parent - - - info [#1/127.0.0.1:47757] phase: running
1340904724.829480 bro parent - - - info terminating... 1342748980.793108 bro parent - - - info terminating...
1340904724.832952 bro child - - - info terminating 1342748980.796454 bro child - - - info terminating
1340904724.834082 bro parent - - - info [#1/127.0.0.1:47757] closing connection 1342748980.797536 bro parent - - - info [#1/127.0.0.1:47757] closing connection
#end 2012-07-20-01-49-40

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh-new-default #path ssh-new-default
#start 2012-07-20-01-49-19
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314313.140603 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748959.430282 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314313.140603 1.2.3.4 1234 2.3.4.5 80 failure US 1342748959.430282 1.2.3.4 1234 2.3.4.5 80 failure US
#end 2012-07-20-01-49-19

View file

@ -3,8 +3,10 @@
#empty_field|(empty) #empty_field|(empty)
#unset_field|- #unset_field|-
#path|ssh #path|ssh
#start|2012-07-20-01-49-19
#fields|data|data2 #fields|data|data2
#types|string|string #types|string|string
abc\x0a\xffdef|DATA2 abc\x0a\xffdef|DATA2
abc\x7c\xffdef|DATA2 abc\x7c\xffdef|DATA2
abc\xff\x7cdef|DATA2 abc\xff\x7cdef|DATA2
#end|2012-07-20-01-49-19

View file

@ -5,8 +5,8 @@ PREFIX<>unset_field|NOT-SET
PREFIX<>path|ssh PREFIX<>path|ssh
PREFIX<>fields|t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b PREFIX<>fields|t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b
PREFIX<>types|time|addr|port|addr|port|string|string|bool PREFIX<>types|time|addr|port|addr|port|string|string|bool
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET 1342748959.659721|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET 1342748959.659721|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET 1342748959.659721|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET 1342748959.659721|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET
1342126762.852986|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T 1342748959.659721|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2012-07-20-01-49-19
#fields x y z #fields x y z
#types string string string #types string string string
\x2d - (empty) \x2d - (empty)
#end 2012-07-20-01-49-19

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2011-09-12-03-57-36
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 1 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 346 404 Not Found - - - (empty) - - - text/html - - 1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 1 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 346 404 Not Found - - - (empty) - - - text/html - -
#end 2011-09-12-03-57-37

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2012-07-20-01-49-19
#fields ss #fields ss
#types table[string] #types table[string]
CC,AA,\x2c,\x2c\x2c CC,AA,\x2c,\x2c\x2c
#end 2012-07-20-01-49-19

View file

@ -5,8 +5,8 @@
#path||ssh #path||ssh
#fields||t||id.orig_h||id.orig_p||id.resp_h||id.resp_p||status||country #fields||t||id.orig_h||id.orig_p||id.resp_h||id.resp_p||status||country
#types||time||addr||port||addr||port||string||string #types||time||addr||port||addr||port||string||string
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||success||unknown 1342759749.586006||1.2.3.4||1234||2.3.4.5||80||success||unknown
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||failure||US 1342759749.586006||1.2.3.4||1234||2.3.4.5||80||failure||US
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||fa\x7c\x7cure||UK 1342759749.586006||1.2.3.4||1234||2.3.4.5||80||fa\x7c\x7cure||UK
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||su\x7c\x7cess||BR 1342759749.586006||1.2.3.4||1234||2.3.4.5||80||su\x7c\x7cess||BR
1324314313.899736||1.2.3.4||1234||2.3.4.5||80||failure||MX 1342759749.586006||1.2.3.4||1234||2.3.4.5||80||failure||MX

View file

@ -3,10 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2012-07-12-21-00-27 #start 2012-07-20-01-49-22
#fields data c #fields data c
#types string count #types string count
Test1 42 Test1 42
\x23Kaputt 42 \x23Kaputt 42
Test2 42 Test2 42
#end 2012-07-12-21-00-27 #end 2012-07-20-01-49-22

View file

@ -1,5 +1,5 @@
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|success|unknown 1342748960.098729|1.2.3.4|1234|2.3.4.5|80|success|unknown
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|US 1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|US
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|UK 1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|UK
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|success|BR 1342748960.098729|1.2.3.4|1234|2.3.4.5|80|success|BR
1324314313.990741|1.2.3.4|1234|2.3.4.5|80|failure|MX 1342748960.098729|1.2.3.4|1234|2.3.4.5|80|failure|MX

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2012-07-20-01-49-20
#fields data #fields data
#types time #types time
1234567890.000000 1234567890.000000
@ -13,3 +14,4 @@
1234567890.000010 1234567890.000010
1234567890.000001 1234567890.000001
1234567890.000000 1234567890.000000
#end 2012-07-20-01-49-20

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields status country a1 b1 b2 #fields status country a1 b1 b2
#types string string count count count #types string string count count count
success unknown 1 3 4 success unknown 1 3 4
#end 2012-07-20-01-49-20

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields status country #fields status country
#types string string #types string string
success unknown success unknown
@ -10,3 +11,4 @@ failure US
failure UK failure UK
success BR success BR
failure MX failure MX
#end 2012-07-20-01-49-20

View file

@ -27,8 +27,8 @@
# Extent, type='ssh' # Extent, type='ssh'
t id.orig_h id.orig_p id.resp_h id.resp_p status country t id.orig_h id.orig_p id.resp_h id.resp_p status country
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748962.493341 1.2.3.4 1234 2.3.4.5 80 success unknown
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure US 1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure US
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure UK
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 success BR 1342748962.493341 1.2.3.4 1234 2.3.4.5 80 success BR
1337216256.956476 1.2.3.4 1234 2.3.4.5 80 failure MX 1342748962.493341 1.2.3.4 1234 2.3.4.5 80 failure MX

View file

@ -3,10 +3,12 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748960.468458 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure US 1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure US
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 success BR 1342748960.468458 1.2.3.4 1234 2.3.4.5 80 success BR
1324314314.443785 1.2.3.4 1234 2.3.4.5 80 failure MX 1342748960.468458 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-49-20

View file

@ -1,2 +1,2 @@
[t=1324314314.738385, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=success, country=unknown] [t=1342748960.593451, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=success, country=unknown]
[t=1324314314.738385, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=failure, country=US] [t=1342748960.593451, id=[orig_h=1.2.3.4, orig_p=1234/tcp, resp_h=2.3.4.5, resp_p=80/tcp], status=failure, country=US]

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields id.orig_p id.resp_h id.resp_p status country #fields id.orig_p id.resp_h id.resp_p status country
#types port addr port string string #types port addr port string string
1234 2.3.4.5 80 success unknown 1234 2.3.4.5 80 success unknown
@ -10,3 +11,4 @@
1234 2.3.4.5 80 failure UK 1234 2.3.4.5 80 failure UK
1234 2.3.4.5 80 success BR 1234 2.3.4.5 80 success BR
1234 2.3.4.5 80 failure MX 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-49-20

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields t f #fields t f
#types time file #types time file
1324314314.940195 Foo.log 1342748960.757056 Foo.log
#end 2012-07-20-01-49-20

View file

@ -3,10 +3,12 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-20
#fields t id.orig_h #fields t id.orig_h
#types time addr #types time addr
1324314315.040480 1.2.3.4 1342748960.796093 1.2.3.4
1324314315.040480 1.2.3.4 1342748960.796093 1.2.3.4
1324314315.040480 1.2.3.4 1342748960.796093 1.2.3.4
1324314315.040480 1.2.3.4 1342748960.796093 1.2.3.4
1324314315.040480 1.2.3.4 1342748960.796093 1.2.3.4
#end 2012-07-20-01-49-20

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path local #path local
#start 2011-03-18-19-06-13
#fields ts id.orig_h #fields ts id.orig_h
#types time addr #types time addr
1300475168.859163 141.142.220.118 1300475168.859163 141.142.220.118
@ -35,3 +36,4 @@
1300475168.902195 141.142.220.118 1300475168.902195 141.142.220.118
1300475168.894787 141.142.220.118 1300475168.894787 141.142.220.118
1300475168.901749 141.142.220.118 1300475168.901749 141.142.220.118
#end 2011-03-18-19-06-13

View file

@ -3,9 +3,11 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path remote #path remote
#start 2011-03-18-19-06-13
#fields ts id.orig_h #fields ts id.orig_h
#types time addr #types time addr
1300475169.780331 173.192.163.128 1300475169.780331 173.192.163.128
1300475167.097012 fe80::217:f2ff:fed7:cf65 1300475167.097012 fe80::217:f2ff:fed7:cf65
1300475171.675372 fe80::3074:17d5:2052:c324 1300475171.675372 fe80::3074:17d5:2052:c324
1300475173.116749 fe80::3074:17d5:2052:c324 1300475173.116749 fe80::3074:17d5:2052:c324
#end 2011-03-18-19-06-13

View file

@ -10,54 +10,68 @@ static-prefix-2-UK.log
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-0-BR #path static-prefix-0-BR
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 success BR 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 success BR
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-0-MX3 #path static-prefix-0-MX3
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX3 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX3
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-0-unknown #path static-prefix-0-unknown
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 success unknown
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-1-MX #path static-prefix-1-MX
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-1-US #path static-prefix-1-US
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure US
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-2-MX2 #path static-prefix-2-MX2
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure MX2 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure MX2
#end 2012-07-20-01-49-21
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path static-prefix-2-UK #path static-prefix-2-UK
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.385189 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748961.180156 1.2.3.4 1234 2.3.4.5 80 failure UK
#end 2012-07-20-01-49-21

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test.failure #path test.failure
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.498365 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.488370 1.2.3.4 1234 2.3.4.5 80 failure US
#end 2012-07-20-01-49-21

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test.success #path test.success
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314315.498365 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748961.488370 1.2.3.4 1234 2.3.4.5 80 success unknown
#end 2012-07-20-01-49-21

View file

@ -3,6 +3,8 @@
#empty_field EMPTY #empty_field EMPTY
#unset_field - #unset_field -
#path test #path test
#start 1970-01-01-00-00-00
#fields b i e c p sn a d t iv s sc ss se vc ve #fields b i e c p sn a d t iv s sc ss se vc ve
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] #types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string]
T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1324314315.880694 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1342749004.579242 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
#end 2012-07-20-01-50-05

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test.failure #path test.failure
#start 2012-07-20-01-50-18
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure US 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure US
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure UK 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure MX 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-50-18

View file

@ -3,10 +3,12 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2012-07-20-01-50-18
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success unknown 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure US 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure US
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure UK 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success BR 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success BR
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 failure MX 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-50-18

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test.success #path test.success
#start 2012-07-20-01-50-18
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success unknown 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314321.061516 1.2.3.4 1234 2.3.4.5 80 success BR 1342749018.970682 1.2.3.4 1234 2.3.4.5 80 success BR
#end 2012-07-20-01-50-18

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh.failure #path ssh.failure
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure US
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure UK
#end 2012-07-20-01-49-21

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure US
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314328.196443 1.2.3.4 1234 2.3.4.5 80 failure BR 1342748961.521536 1.2.3.4 1234 2.3.4.5 80 failure BR
#end 2012-07-20-01-49-21

View file

@ -19,11 +19,31 @@ custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_11.59.55.log, pat
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.00.05.log, path=test2, open=1299499205.0, close=1299502795.0, terminating=F] custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.00.05.log, path=test2, open=1299499205.0, close=1299502795.0, terminating=F]
custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.59.55.log, path=test2, open=1299502795.0, close=1299502795.0, terminating=T] custom rotate, [writer=Log::WRITER_ASCII, fname=test2-11-03-07_12.59.55.log, path=test2, open=1299502795.0, close=1299502795.0, terminating=T]
#empty_field (empty) #empty_field (empty)
#end 2011-03-07-03-59-55
#end 2011-03-07-04-00-05
#end 2011-03-07-04-59-55
#end 2011-03-07-05-00-05
#end 2011-03-07-05-59-55
#end 2011-03-07-06-00-05
#end 2011-03-07-06-59-55
#end 2011-03-07-07-00-05
#end 2011-03-07-07-59-55
#end 2011-03-07-08-00-05
#end 2011-03-07-08-59-55
#end 2011-03-07-09-00-05
#end 2011-03-07-09-59-55
#end 2011-03-07-10-00-05
#end 2011-03-07-10-59-55
#end 2011-03-07-11-00-05
#end 2011-03-07-11-59-55
#end 2011-03-07-12-00-05
#end 2011-03-07-12-59-55
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#path test #path test
#path test2 #path test2
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#start 2011-03-07-03-00-05
#types time addr port addr port #types time addr port addr port
#unset_field - #unset_field -
1299466805.000000 10.0.0.1 20 10.0.0.2 1024 1299466805.000000 10.0.0.1 20 10.0.0.2 1024

View file

@ -14,97 +14,117 @@ test.2011-03-07-12-00-05.log test 11-03-07_12.00.05 11-03-07_12.59.55 1 ascii
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299466805.000000 10.0.0.1 20 10.0.0.2 1024 1299466805.000000 10.0.0.1 20 10.0.0.2 1024
1299470395.000000 10.0.0.2 20 10.0.0.3 0 1299470395.000000 10.0.0.2 20 10.0.0.3 0
#end 2011-03-07-04-00-05
> test.2011-03-07-04-00-05.log > test.2011-03-07-04-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299470405.000000 10.0.0.1 20 10.0.0.2 1025 1299470405.000000 10.0.0.1 20 10.0.0.2 1025
1299473995.000000 10.0.0.2 20 10.0.0.3 1 1299473995.000000 10.0.0.2 20 10.0.0.3 1
#end 2011-03-07-05-00-05
> test.2011-03-07-05-00-05.log > test.2011-03-07-05-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299474005.000000 10.0.0.1 20 10.0.0.2 1026 1299474005.000000 10.0.0.1 20 10.0.0.2 1026
1299477595.000000 10.0.0.2 20 10.0.0.3 2 1299477595.000000 10.0.0.2 20 10.0.0.3 2
#end 2011-03-07-06-00-05
> test.2011-03-07-06-00-05.log > test.2011-03-07-06-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299477605.000000 10.0.0.1 20 10.0.0.2 1027 1299477605.000000 10.0.0.1 20 10.0.0.2 1027
1299481195.000000 10.0.0.2 20 10.0.0.3 3 1299481195.000000 10.0.0.2 20 10.0.0.3 3
#end 2011-03-07-07-00-05
> test.2011-03-07-07-00-05.log > test.2011-03-07-07-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299481205.000000 10.0.0.1 20 10.0.0.2 1028 1299481205.000000 10.0.0.1 20 10.0.0.2 1028
1299484795.000000 10.0.0.2 20 10.0.0.3 4 1299484795.000000 10.0.0.2 20 10.0.0.3 4
#end 2011-03-07-08-00-05
> test.2011-03-07-08-00-05.log > test.2011-03-07-08-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299484805.000000 10.0.0.1 20 10.0.0.2 1029 1299484805.000000 10.0.0.1 20 10.0.0.2 1029
1299488395.000000 10.0.0.2 20 10.0.0.3 5 1299488395.000000 10.0.0.2 20 10.0.0.3 5
#end 2011-03-07-09-00-05
> test.2011-03-07-09-00-05.log > test.2011-03-07-09-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299488405.000000 10.0.0.1 20 10.0.0.2 1030 1299488405.000000 10.0.0.1 20 10.0.0.2 1030
1299491995.000000 10.0.0.2 20 10.0.0.3 6 1299491995.000000 10.0.0.2 20 10.0.0.3 6
#end 2011-03-07-10-00-05
> test.2011-03-07-10-00-05.log > test.2011-03-07-10-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299492005.000000 10.0.0.1 20 10.0.0.2 1031 1299492005.000000 10.0.0.1 20 10.0.0.2 1031
1299495595.000000 10.0.0.2 20 10.0.0.3 7 1299495595.000000 10.0.0.2 20 10.0.0.3 7
#end 2011-03-07-11-00-05
> test.2011-03-07-11-00-05.log > test.2011-03-07-11-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299495605.000000 10.0.0.1 20 10.0.0.2 1032 1299495605.000000 10.0.0.1 20 10.0.0.2 1032
1299499195.000000 10.0.0.2 20 10.0.0.3 8 1299499195.000000 10.0.0.2 20 10.0.0.3 8
#end 2011-03-07-12-00-05
> test.2011-03-07-12-00-05.log > test.2011-03-07-12-00-05.log
#separator \x09 #separator \x09
#set_separator , #set_separator ,
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path test #path test
#start 2011-03-07-03-00-05
#fields t id.orig_h id.orig_p id.resp_h id.resp_p #fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port #types time addr port addr port
1299499205.000000 10.0.0.1 20 10.0.0.2 1033 1299499205.000000 10.0.0.1 20 10.0.0.2 1033
1299502795.000000 10.0.0.2 20 10.0.0.3 9 1299502795.000000 10.0.0.2 20 10.0.0.3 9
#end 2011-03-07-12-59-55

View file

@ -3,10 +3,12 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path /dev/stdout #path /dev/stdout
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748961.732599 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure US
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 success BR 1342748961.732599 1.2.3.4 1234 2.3.4.5 80 success BR
1324314328.844271 1.2.3.4 1234 2.3.4.5 80 failure MX 1342748961.732599 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-49-21

View file

@ -3,10 +3,12 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-21
#fields t id.orig_h id.orig_p id.resp_h id.resp_p status country #fields t id.orig_h id.orig_p id.resp_h id.resp_p status country
#types time addr port addr port string string #types time addr port addr port string string
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 success unknown 1342748961.748481 1.2.3.4 1234 2.3.4.5 80 success unknown
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure US 1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure US
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure UK 1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure UK
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 success BR 1342748961.748481 1.2.3.4 1234 2.3.4.5 80 success BR
1324314328.950525 1.2.3.4 1234 2.3.4.5 80 failure MX 1342748961.748481 1.2.3.4 1234 2.3.4.5 80 failure MX
#end 2012-07-20-01-49-21

View file

@ -3,6 +3,8 @@
#empty_field EMPTY #empty_field EMPTY
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-22
#fields b i e c p sn a d t iv s sc ss se vc ve f #fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] func #types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1324314329.051618 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a} T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1342748962.114672 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
#end 2012-07-20-01-49-22

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path testing #path testing
#start 2012-07-20-01-49-22
#fields a.val1 a.val2 b #fields a.val1 a.val2 b
#types count count count #types count count count
- - 6 - - 6
1 2 3 1 2 3
#end 2012-07-20-01-49-22

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ssh #path ssh
#start 2012-07-20-01-49-22
#fields vec #fields vec
#types vector[string] #types vector[string]
-,2,-,-,5 -,2,-,-,5
#end 2012-07-20-01-49-22

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path metrics #path metrics
#start 2012-07-20-01-50-41
#fields ts metric_id filter_name index.host index.str index.network value #fields ts metric_id filter_name index.host index.str index.network value
#types time enum string addr string subnet count #types time enum string addr string subnet count
1328303679.867377 TEST_METRIC foo-bar 6.5.4.3 - - 4 1342749041.601712 TEST_METRIC foo-bar 6.5.4.3 - - 4
1328303679.867377 TEST_METRIC foo-bar 7.2.1.5 - - 2 1342749041.601712 TEST_METRIC foo-bar 7.2.1.5 - - 2
1328303679.867377 TEST_METRIC foo-bar 1.2.3.4 - - 6 1342749041.601712 TEST_METRIC foo-bar 1.2.3.4 - - 6
#end 2012-07-20-01-50-49

View file

@ -3,8 +3,10 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path metrics #path metrics
#start 2012-07-20-01-49-22
#fields ts metric_id filter_name index.host index.str index.network value #fields ts metric_id filter_name index.host index.str index.network value
#types time enum string addr string subnet count #types time enum string addr string subnet count
1328303763.333948 TEST_METRIC foo-bar 6.5.4.3 - - 2 1342748962.841548 TEST_METRIC foo-bar 6.5.4.3 - - 2
1328303763.333948 TEST_METRIC foo-bar 7.2.1.5 - - 1 1342748962.841548 TEST_METRIC foo-bar 7.2.1.5 - - 1
1328303763.333948 TEST_METRIC foo-bar 1.2.3.4 - - 3 1342748962.841548 TEST_METRIC foo-bar 1.2.3.4 - - 3
#end 2012-07-20-01-49-22

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path notice #path notice
#start 2012-07-20-01-50-59
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet #types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
1325633225.777902 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 100/100 - 1.2.3.4 - - 100 manager-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - - 1342749059.978651 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 100/100 - 1.2.3.4 - - 100 manager-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
#end 2012-07-20-01-51-08

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path notice #path notice
#start 2012-07-20-01-49-23
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet #types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
1325633274.875473 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 3/2 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - - 1342748963.085888 - - - - - - Test_Notice Threshold crossed by metric_index(host=1.2.3.4) 3/2 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 1.2.3.4 - -
1325633274.875473 - - - - - - Test_Notice Threshold crossed by metric_index(host=6.5.4.3) 2/2 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 6.5.4.3 - - 1342748963.085888 - - - - - - Test_Notice Threshold crossed by metric_index(host=6.5.4.3) 2/2 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 6.5.4.3 - -
#end 2012-07-20-01-49-23

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path notice #path notice
#start 2012-07-20-01-51-18
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet #types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
1325633122.490990 - - - - - - Test_Notice test notice! - - - - - worker-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - - 1342749078.270791 - - - - - - Test_Notice test notice! - - - - - worker-1 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
#end 2012-07-20-01-51-27

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path notice #path notice
#start 2012-07-20-01-51-36
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet #types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
1325633150.723248 - - - - - - Test_Notice test notice! - - - - - worker-2 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - - 1342749096.545663 - - - - - - Test_Notice test notice! - - - - - worker-2 Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
#end 2012-07-20-01-51-45

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path notice #path notice
#start 2012-07-20-01-49-23
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double #types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double
1325633207.922993 - - - - - - Test_Notice test - - - - - bro Notice::ACTION_LOG 6 3600.000000 F - - - - - 1342748963.685754 - - - - - - Test_Notice test - - - - - bro Notice::ACTION_LOG 6 3600.000000 F - - - - -
#end 2012-07-20-01-49-23

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2012-02-21-16-53-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1329843175.736107 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty) 1329843175.736107 arKYeMETxOg 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - 0 ShAdfFa 4 216 4 562 (empty)
@ -10,3 +11,4 @@
1329843194.151526 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty) 1329843194.151526 nQcgTWjvg4c 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - 0 ShADaFf 5 614 3 164 (empty)
1329843197.783443 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty) 1329843197.783443 j4u32Pc5bif 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - 0 ShADaFf 5 349 3 164 (empty)
1329843161.968492 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty) 1329843161.968492 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - 0 ShAdDfFa 38 2164 25 4458 (empty)
#end 2012-02-21-16-53-20

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ftp #path ftp
#start 2012-02-21-16-53-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
#types time string addr port addr port string string string string string string count count string table[string] file #types time string addr port addr port string string string string string string count count string table[string] file
1329843179.926563 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text 77 226 Transfer complete. - - 1329843179.926563 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text 77 226 Transfer complete. - -
1329843197.727769 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text, with CRLF line terminators 77 226 Transfer complete. - - 1329843197.727769 UWkUyAuUGXf 141.142.220.235 50003 199.233.217.249 21 anonymous test RETR ftp://199.233.217.249/./robots.txt text/plain ASCII text, with CRLF line terminators 77 226 Transfer complete. - -
#end 2012-02-21-16-53-20

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path conn #path conn
#start 2012-02-15-17-43-15
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] #types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
1329327783.316897 arKYeMETxOg 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - 0 ShAdfFa 5 372 4 642 (empty) 1329327783.316897 arKYeMETxOg 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - 0 ShAdfFa 5 372 4 642 (empty)
@ -11,3 +12,4 @@
1329327795.571921 j4u32Pc5bif 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - 0 ShADFaf 5 449 4 300 (empty) 1329327795.571921 j4u32Pc5bif 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - 0 ShADFaf 5 449 4 300 (empty)
1329327777.822004 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - 0 ShAdDfFa 57 4426 34 5908 (empty) 1329327777.822004 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - 0 ShAdDfFa 57 4426 34 5908 (empty)
1329327800.017649 TEfuqmmG4bh 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - 0 ShADFaf 5 714 4 300 (empty) 1329327800.017649 TEfuqmmG4bh 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - 0 ShADFaf 5 714 4 300 (empty)
#end 2012-02-15-17-43-24

View file

@ -3,7 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path ftp #path ftp
#start 2012-02-15-17-43-07
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p user password command arg mime_type mime_desc file_size reply_code reply_msg tags extraction_file
#types time string addr port addr port string string string string string string count count string table[string] file #types time string addr port addr port string string string string string string count count string table[string] file
1329327787.396984 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - - 1329327787.396984 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
1329327795.463946 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - - 1329327795.463946 UWkUyAuUGXf 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 anonymous test RETR ftp://[2001:470:4867:99::21]/robots.txt - - 77 226 Transfer complete. - -
#end 2012-02-15-17-43-24

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2009-03-19-05-21-36
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 1 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 60731 200 OK 100 Continue - (empty) - - - text/html - - 1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 1 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 60731 200 OK 100 Continue - (empty) - - - text/html - -
#end 2009-03-19-05-21-36

View file

@ -3,6 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2005-10-07-23-23-56
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat 1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - text/html - http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat
#end 2005-10-07-23-23-57

View file

@ -3,6 +3,7 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path http #path http
#start 2009-11-18-20-58-04
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file #types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 1 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2675 200 OK - - - (empty) - - - FAKE_MIME - - 1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 1 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2675 200 OK - - - (empty) - - - FAKE_MIME - -
@ -10,3 +11,4 @@
1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 3 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 94 200 OK - - - (empty) - - - FAKE_MIME - - 1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 3 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 94 200 OK - - - (empty) - - - FAKE_MIME - -
1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 4 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2349 200 OK - - - (empty) - - - image/png e0029eea80812e9a8e57b8d05d52938a - 1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 4 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 2349 200 OK - - - (empty) - - - image/png e0029eea80812e9a8e57b8d05d52938a -
1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 5 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 27579 200 OK - - - (empty) - - - image/png 30aa926344f58019d047e85ba049ca1e - 1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 5 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 27579 200 OK - - - (empty) - - - image/png 30aa926344f58019d047e85ba049ca1e -
#end 2009-11-18-20-58-32

Some files were not shown because too many files have changed in this diff Show more