diff --git a/src/LogWriterAscii.cc b/src/LogWriterAscii.cc index 446d6c8d65..fc589d8cb9 100644 --- a/src/LogWriterAscii.cc +++ b/src/LogWriterAscii.cc @@ -6,6 +6,54 @@ #include "LogWriterAscii.h" #include "NetVar.h" +/** + * Takes a LogField and returns a human-readable version of its type. Used to output the type to the log file's + * header. + * + * @param field Switches on field->type and returns an appropriate human-readable representation of that type. + * @return A std::string containing the human-readable representation of a given field's type. + */ +static string _GetBroTypeString(const LogField *field) +{ + switch(field->type) + { + case TYPE_BOOL: + return "bool"; + case TYPE_COUNT: + return "count"; + case TYPE_COUNTER: + return "counter"; + case TYPE_PORT: + return "port"; + case TYPE_INT: + return "int"; + case TYPE_TIME: + return "time"; + case TYPE_INTERVAL: + return "interval"; + case TYPE_DOUBLE: + return "double"; + case TYPE_SUBNET: + return "subnet"; + case TYPE_NET: + return "net"; + case TYPE_ADDR: + return "addr"; + case TYPE_ENUM: + return "enum"; + case TYPE_STRING: + return "string"; + case TYPE_FILE: + return "file"; + case TYPE_TABLE: + return "table"; + case TYPE_VECTOR: + return "vector"; + default: + return "???"; + } +} + LogWriterAscii::LogWriterAscii() { file = 0; @@ -87,6 +135,23 @@ bool LogWriterAscii::DoInit(string path, int num_fields, if ( fputc('\n', file) == EOF ) goto write_error; + + string wString = string(header_prefix, header_prefix_len) + string("path:'") + path + string("'\n"); + wString += string(header_prefix, header_prefix_len) + "separator:'" + string(separator, separator_len) + "'\n"; + if(fwrite(wString.c_str(), wString.length(), 1, file) != 1) + goto write_error; + + wString = string(header_prefix, header_prefix_len); + for ( int i = 0; i < num_fields; ++i ) + { + const LogField* field = fields[i]; + wString += ((i > 0) ? string(separator, separator_len) : string("")) + field->name + string("=") + _GetBroTypeString(field); + } + if(fwrite(wString.c_str(), wString.length(), 1, file) != 1) + goto write_error; + if ( fputc('\n', file) == EOF ) + goto write_error; + } return true; diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log b/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log index a744346519..830556743a 100644 --- a/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log +++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history +# path:'conn' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port proto=enum service=string duration=interval orig_bytes=count resp_bytes=count conn_state=string local_orig=bool missed_bytes=count history=string 1128727435.450898 UWkUyAuUGXf 141.42.64.125 56730 125.190.109.199 80 tcp http 1.73330307006836 98 9417 SF - 0 ShADdFaf diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv4/output b/testing/btest/Baseline/core.print-bpf-filters-ipv4/output index 494e1946e7..6ffc30b379 100644 --- a/testing/btest/Baseline/core.print-bpf-filters-ipv4/output +++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/output @@ -1,8 +1,20 @@ # ts node filter init success -1312570784.336354 - not ip6 F T +# path:'packet_filter' +# separator:' ' +# ts=time node=string filter=string init=bool success=bool +1313294321.706635 - not ip6 F T # ts node filter init success -1312570784.550594 - (((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (udp and port 5353)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port smtp or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666)) and (not ip6) F T +# path:'packet_filter' +# separator:' ' +# ts=time node=string filter=string init=bool success=bool +1313294321.886625 - (((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (udp and port 5353)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port smtp or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666)) and (not ip6) F T # ts node filter init success -1312570784.765990 - port 42 F T +# path:'packet_filter' +# separator:' ' +# ts=time node=string filter=string init=bool success=bool +1313294322.054107 - port 42 F T # ts node filter init success -1312570784.992999 - port 56730 T T +# path:'packet_filter' +# separator:' ' +# ts=time node=string filter=string init=bool success=bool +1313294322.221475 - port 56730 T T diff --git a/testing/btest/Baseline/core.vlan-mpls/conn.log b/testing/btest/Baseline/core.vlan-mpls/conn.log index 1d46bd7ab1..4202037144 100644 --- a/testing/btest/Baseline/core.vlan-mpls/conn.log +++ b/testing/btest/Baseline/core.vlan-mpls/conn.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history +# path:'conn' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port proto=enum service=string duration=interval orig_bytes=count resp_bytes=count conn_state=string local_orig=bool missed_bytes=count history=string 952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.10255992412567 25 0 SH - 0 - 1128727435.450898 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 tcp http 1.73330307006836 98 9417 SF - 0 ShADdFaf 1278600802.069419 50da4BEzauh 10.20.80.1 50343 10.0.0.15 80 tcp - 0.00415205955505371 9 3429 SF - 0 ShADadfF diff --git a/testing/btest/Baseline/istate.events-ssl/receiver.http.log b/testing/btest/Baseline/istate.events-ssl/receiver.http.log index 2e56522dae..8eeff70133 100644 --- a/testing/btest/Baseline/istate.events-ssl/receiver.http.log +++ b/testing/btest/Baseline/istate.events-ssl/receiver.http.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file -1310750785.32134 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table mime_type=string md5=string extraction_file=file +1313294803.616197 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events-ssl/sender.http.log b/testing/btest/Baseline/istate.events-ssl/sender.http.log index 2e56522dae..8eeff70133 100644 --- a/testing/btest/Baseline/istate.events-ssl/sender.http.log +++ b/testing/btest/Baseline/istate.events-ssl/sender.http.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file -1310750785.32134 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table mime_type=string md5=string extraction_file=file +1313294803.616197 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events/receiver.http.log b/testing/btest/Baseline/istate.events/receiver.http.log index 38ba563dc7..9aa3b8b299 100644 --- a/testing/btest/Baseline/istate.events/receiver.http.log +++ b/testing/btest/Baseline/istate.events/receiver.http.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file -1310750770.8185 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table mime_type=string md5=string extraction_file=file +1313294821.853639 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events/sender.http.log b/testing/btest/Baseline/istate.events/sender.http.log index 38ba563dc7..9aa3b8b299 100644 --- a/testing/btest/Baseline/istate.events/sender.http.log +++ b/testing/btest/Baseline/istate.events/sender.http.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file -1310750770.8185 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table mime_type=string md5=string extraction_file=file +1313294821.853639 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - - diff --git a/testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log b/testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log index ee274bb0fa..a6801462ef 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log +++ b/testing/btest/Baseline/policy.frameworks.logging.adapt-filter/ssh-new-default.log @@ -1,3 +1,6 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212563.234939 1.2.3.4 1234 2.3.4.5 80 success unknown -1313212563.234939 1.2.3.4 1234 2.3.4.5 80 failure US +# path:'ssh-new-default' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294629.401535 1.2.3.4 1234 2.3.4.5 80 success unknown +1313294629.401535 1.2.3.4 1234 2.3.4.5 80 failure US diff --git a/testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log index 84a2cc609e..12433a10eb 100644 Binary files a/testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log and b/testing/btest/Baseline/policy.frameworks.logging.ascii-binary/ssh.log differ diff --git a/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log index d377ca15d7..510093520c 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log @@ -1,6 +1,9 @@ PREFIX<>t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b -1299718506.56593|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET -1299718506.56593|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET -1299718506.56593|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET -1299718506.56593|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET -1299718506.56593|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T +PREFIX<>path:'ssh' +PREFIX<>separator:'|' +PREFIX<>t=time|id.orig_h=addr|id.orig_p=port|id.resp_h=addr|id.resp_p=port|status=string|country=string|b=bool +1313294759.195743|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET +1313294759.195743|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET +1313294759.195743|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET +1313294759.195743|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET +1313294759.195743|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T diff --git a/testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log index aa08625281..bd3dd8d191 100644 Binary files a/testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log and b/testing/btest/Baseline/policy.frameworks.logging.ascii-escape/ssh.log differ diff --git a/testing/btest/Baseline/policy.frameworks.logging.ascii-timestamps/test.log b/testing/btest/Baseline/policy.frameworks.logging.ascii-timestamps/test.log index fb7ae6d486..861e1588e6 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.ascii-timestamps/test.log +++ b/testing/btest/Baseline/policy.frameworks.logging.ascii-timestamps/test.log @@ -1,4 +1,7 @@ # data +# path:'test' +# separator:' ' +# data=time 1234567890.000000 1234567890.000000 1234567890.010000 diff --git a/testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log index d543af3a43..66d3ecd7e5 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.attr-extend/ssh.log @@ -1,2 +1,5 @@ # status country a1 b1 b2 +# path:'ssh' +# separator:' ' +# status=string country=string a1=count b1=count b2=count success unknown 1 3 4 diff --git a/testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log index c4355d2fd5..d8204b80ae 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.attr/ssh.log @@ -1,4 +1,7 @@ # status country +# path:'ssh' +# separator:' ' +# status=string country=string success unknown failure US failure UK diff --git a/testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log index 7f21430ea7..2bbdfc5598 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.empty-event/ssh.log @@ -1,6 +1,9 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success unknown -1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure US -1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure UK -1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success BR -1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'ssh' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294569.495672 1.2.3.4 1234 2.3.4.5 80 success unknown +1313294569.495672 1.2.3.4 1234 2.3.4.5 80 failure US +1313294569.495672 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294569.495672 1.2.3.4 1234 2.3.4.5 80 success BR +1313294569.495672 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log index 4defa5ced1..b19e940b32 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.exclude/ssh.log @@ -1,4 +1,7 @@ # id.orig_p id.resp_h id.resp_p status country +# path:'ssh' +# separator:' ' +# id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string 1234 2.3.4.5 80 success unknown 1234 2.3.4.5 80 failure US 1234 2.3.4.5 80 failure UK diff --git a/testing/btest/Baseline/policy.frameworks.logging.file/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.file/ssh.log index 49115ab1df..d161b04fee 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.file/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.file/ssh.log @@ -1,2 +1,5 @@ # t f -1303098703.62603 Foo.log +# path:'ssh' +# separator:' ' +# t=time f=file +1313294659.301877 Foo.log diff --git a/testing/btest/Baseline/policy.frameworks.logging.include/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.include/ssh.log index 881704257e..63329d38fd 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.include/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.include/ssh.log @@ -1,6 +1,9 @@ # t id.orig_h -1303064007.48299 1.2.3.4 -1303064007.48299 1.2.3.4 -1303064007.48299 1.2.3.4 -1303064007.48299 1.2.3.4 -1303064007.48299 1.2.3.4 +# path:'ssh' +# separator:' ' +# t=time id.orig_h=addr +1313294779.446569 1.2.3.4 +1313294779.446569 1.2.3.4 +1313294779.446569 1.2.3.4 +1313294779.446569 1.2.3.4 +1313294779.446569 1.2.3.4 diff --git a/testing/btest/Baseline/policy.frameworks.logging.path-func/output b/testing/btest/Baseline/policy.frameworks.logging.path-func/output index 7e8acf5106..93560dad22 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.path-func/output +++ b/testing/btest/Baseline/policy.frameworks.logging.path-func/output @@ -6,16 +6,37 @@ static-prefix-1-US.log static-prefix-2-MX2.log static-prefix-2-UK.log # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 success BR +# path:'static-prefix-0-BR' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 success BR # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 failure MX3 +# path:'static-prefix-0-MX3' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 failure MX3 # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 success unknown +# path:'static-prefix-0-unknown' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 success unknown # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'static-prefix-1-MX' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 failure MX # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 failure US +# path:'static-prefix-1-US' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 failure US # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 failure MX2 +# path:'static-prefix-2-MX2' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 failure MX2 # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1313212701.542245 1.2.3.4 1234 2.3.4.5 80 failure UK +# path:'static-prefix-2-UK' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294713.688145 1.2.3.4 1234 2.3.4.5 80 failure UK diff --git a/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log index c46990dc65..bfe4b166ba 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log +++ b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.failure.log @@ -1,2 +1,5 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718503.16177 1.2.3.4 1234 2.3.4.5 80 failure US +# path:'ssh.failure' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294637.607505 1.2.3.4 1234 2.3.4.5 80 failure US diff --git a/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log index c6adcd86aa..4288669eb2 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log +++ b/testing/btest/Baseline/policy.frameworks.logging.pred/ssh.success.log @@ -1,2 +1,5 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718503.16177 1.2.3.4 1234 2.3.4.5 80 success - +# path:'ssh.success' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294637.607505 1.2.3.4 1234 2.3.4.5 80 success - diff --git a/testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log b/testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log index 865786eb2f..9fd99886fd 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log @@ -1,2 +1,5 @@ # b i e c p sn n a d t iv s sc ss se vc ve -T -42 Test::TEST 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1312565184.899030 100.0 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY +# path:'test' +# separator:' ' +# b=bool i=int e=enum c=count p=port sn=subnet n=net a=addr d=double t=time iv=interval s=string sc=table ss=table se=table vc=vector ve=vector +T -42 Test::TEST 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1313294605.568014 100.0 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY diff --git a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.failure.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.failure.log index 87f5fb3bcb..029ea30dc2 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.failure.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.failure.log @@ -1,4 +1,7 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure US -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure UK -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'test.failure' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure US +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.log index 8d0fedd1b5..70d339700e 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.log @@ -1,6 +1,9 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 success - -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure US -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure UK -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 success BR -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 success - +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure US +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 success BR +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.success.log b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.success.log index 4b8f54e7ce..be29379d2c 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.success.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remote/sender.test.success.log @@ -1,3 +1,6 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 success - -1312565744.470171 1.2.3.4 1234 2.3.4.5 80 success BR +# path:'test.success' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 success - +1313294726.669862 1.2.3.4 1234 2.3.4.5 80 success BR diff --git a/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log index ddbacda28e..9b6a4a7d07 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.failure.log @@ -1,3 +1,6 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718503.28253 1.2.3.4 1234 2.3.4.5 80 failure US -1299718503.28253 1.2.3.4 1234 2.3.4.5 80 failure UK +# path:'ssh.failure' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294785.141559 1.2.3.4 1234 2.3.4.5 80 failure US +1313294785.141559 1.2.3.4 1234 2.3.4.5 80 failure UK diff --git a/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log index 123e8e3a87..75306f5159 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.remove/ssh.log @@ -1,4 +1,7 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718503.28253 1.2.3.4 1234 2.3.4.5 80 failure US -1299718503.28253 1.2.3.4 1234 2.3.4.5 80 failure UK -1299718503.28253 1.2.3.4 1234 2.3.4.5 80 failure BR +# path:'ssh' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294785.141559 1.2.3.4 1234 2.3.4.5 80 failure US +1313294785.141559 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294785.141559 1.2.3.4 1234 2.3.4.5 80 failure BR diff --git a/testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out b/testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out index 18bd12d88f..6c16b06f92 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out +++ b/testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out @@ -28,7 +28,11 @@ custom rotate, [writer=WRITER_ASCII, fname=test2-11-03-07_11.00.05.log, path=tes custom rotate, [writer=WRITER_ASCII, fname=test2-11-03-07_11.59.55.log, path=test2, open=1299499195.0, close=1299499205.0, terminating=F] custom rotate, [writer=WRITER_ASCII, fname=test2-11-03-07_12.00.05.log, path=test2, open=1299499205.0, close=1299502795.0, terminating=F] custom rotate, [writer=WRITER_ASCII, fname=test2-11-03-07_12.59.55.log, path=test2, open=1299502795.0, close=1299502795.0, terminating=T] +# path:'test' +# path:'test2' +# separator:' ' # t id.orig_h id.orig_p id.resp_h id.resp_p +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299466805.000000 10.0.0.1 20 10.0.0.2 1024 1299470395.000000 10.0.0.2 20 10.0.0.3 0 1299470405.000000 10.0.0.1 20 10.0.0.2 1025 diff --git a/testing/btest/Baseline/policy.frameworks.logging.rotate/out b/testing/btest/Baseline/policy.frameworks.logging.rotate/out index b153c5b7fa..40a9887c13 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.rotate/out +++ b/testing/btest/Baseline/policy.frameworks.logging.rotate/out @@ -10,41 +10,71 @@ test.2011-03-07-11-00-05.log test 11-03-07_11.00.05 11-03-07_12.00.05 0 test.2011-03-07-12-00-05.log test 11-03-07_12.00.05 11-03-07_12.59.55 1 > test.2011-03-07-03-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299466805.000000 10.0.0.1 20 10.0.0.2 1024 1299470395.000000 10.0.0.2 20 10.0.0.3 0 > test.2011-03-07-04-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299470405.000000 10.0.0.1 20 10.0.0.2 1025 1299473995.000000 10.0.0.2 20 10.0.0.3 1 > test.2011-03-07-05-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299474005.000000 10.0.0.1 20 10.0.0.2 1026 1299477595.000000 10.0.0.2 20 10.0.0.3 2 > test.2011-03-07-06-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299477605.000000 10.0.0.1 20 10.0.0.2 1027 1299481195.000000 10.0.0.2 20 10.0.0.3 3 > test.2011-03-07-07-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299481205.000000 10.0.0.1 20 10.0.0.2 1028 1299484795.000000 10.0.0.2 20 10.0.0.3 4 > test.2011-03-07-08-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299484805.000000 10.0.0.1 20 10.0.0.2 1029 1299488395.000000 10.0.0.2 20 10.0.0.3 5 > test.2011-03-07-09-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299488405.000000 10.0.0.1 20 10.0.0.2 1030 1299491995.000000 10.0.0.2 20 10.0.0.3 6 > test.2011-03-07-10-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299492005.000000 10.0.0.1 20 10.0.0.2 1031 1299495595.000000 10.0.0.2 20 10.0.0.3 7 > test.2011-03-07-11-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299495605.000000 10.0.0.1 20 10.0.0.2 1032 1299499195.000000 10.0.0.2 20 10.0.0.3 8 > test.2011-03-07-12-00-05.log # t id.orig_h id.orig_p id.resp_h id.resp_p +# path:'test' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port 1299499205.000000 10.0.0.1 20 10.0.0.2 1033 1299502795.000000 10.0.0.2 20 10.0.0.3 9 diff --git a/testing/btest/Baseline/policy.frameworks.logging.stdout/output b/testing/btest/Baseline/policy.frameworks.logging.stdout/output index 4c73aed8e4..8d9b9fde51 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.stdout/output +++ b/testing/btest/Baseline/policy.frameworks.logging.stdout/output @@ -1,6 +1,9 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718506.28824 1.2.3.4 1234 2.3.4.5 80 success unknown -1299718506.28824 1.2.3.4 1234 2.3.4.5 80 failure US -1299718506.28824 1.2.3.4 1234 2.3.4.5 80 failure UK -1299718506.28824 1.2.3.4 1234 2.3.4.5 80 success BR -1299718506.28824 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'/dev/stdout' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294620.928942 1.2.3.4 1234 2.3.4.5 80 success unknown +1313294620.928942 1.2.3.4 1234 2.3.4.5 80 failure US +1313294620.928942 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294620.928942 1.2.3.4 1234 2.3.4.5 80 success BR +1313294620.928942 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log index 82523b7c13..746685f27e 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.test-logging/ssh.log @@ -1,6 +1,9 @@ # t id.orig_h id.orig_p id.resp_h id.resp_p status country -1299718506.1313 1.2.3.4 1234 2.3.4.5 80 success unknown -1299718506.1313 1.2.3.4 1234 2.3.4.5 80 failure US -1299718506.1313 1.2.3.4 1234 2.3.4.5 80 failure UK -1299718506.1313 1.2.3.4 1234 2.3.4.5 80 success BR -1299718506.1313 1.2.3.4 1234 2.3.4.5 80 failure MX +# path:'ssh' +# separator:' ' +# t=time id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port status=string country=string +1313294707.543971 1.2.3.4 1234 2.3.4.5 80 success unknown +1313294707.543971 1.2.3.4 1234 2.3.4.5 80 failure US +1313294707.543971 1.2.3.4 1234 2.3.4.5 80 failure UK +1313294707.543971 1.2.3.4 1234 2.3.4.5 80 success BR +1313294707.543971 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/Baseline/policy.frameworks.logging.types/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.types/ssh.log index 5666db73c6..38327e2d99 100644 Binary files a/testing/btest/Baseline/policy.frameworks.logging.types/ssh.log and b/testing/btest/Baseline/policy.frameworks.logging.types/ssh.log differ diff --git a/testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log b/testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log index 34f20a588b..3d62164bd4 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log +++ b/testing/btest/Baseline/policy.frameworks.logging.unset-record/testing.log @@ -1,3 +1,6 @@ # a.val1 a.val2 b +# path:'testing' +# separator:' ' +# a.val1=count a.val2=count b=count - - 6 1 2 3 diff --git a/testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log b/testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log index 1602f7d1c0..ffa1f9e94c 100644 --- a/testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log +++ b/testing/btest/Baseline/policy.frameworks.logging.vec/ssh.log @@ -1,2 +1,5 @@ # vec +# path:'ssh' +# separator:' ' +# vec=vector -,2,-,-,5 diff --git a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-all.log b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-all.log index 8eae4b3163..4e1a9d3802 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-all.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-all.log @@ -1,5 +1,8 @@ # ts host -1300475168.78384 141.142.220.118 -1300475168.78384 208.80.152.118 -1300475168.91594 208.80.152.3 -1300475168.96263 208.80.152.2 +# path:'known_hosts' +# separator:' ' +# ts=time host=addr +1300475168.783842 141.142.220.118 +1300475168.783842 208.80.152.118 +1300475168.915940 208.80.152.3 +1300475168.962628 208.80.152.2 diff --git a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-local.log b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-local.log index 91e952dc96..50251059d8 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-local.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-local.log @@ -1,2 +1,5 @@ # ts host -1300475168.78384 141.142.220.118 +# path:'known_hosts' +# separator:' ' +# ts=time host=addr +1300475168.783842 141.142.220.118 diff --git a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-remote.log b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-remote.log index 7224058b56..de3d9e0856 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-remote.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-hosts/knownhosts-remote.log @@ -1,4 +1,7 @@ # ts host -1300475168.78384 208.80.152.118 -1300475168.91594 208.80.152.3 -1300475168.96263 208.80.152.2 +# path:'known_hosts' +# separator:' ' +# ts=time host=addr +1300475168.783842 208.80.152.118 +1300475168.915940 208.80.152.3 +1300475168.962628 208.80.152.2 diff --git a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-all.log b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-all.log index 9e427cbffe..d7be5f3994 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-all.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-all.log @@ -1,6 +1,9 @@ # ts host port_num port_proto service -1308930691.03504 172.16.238.131 22 tcp SSH -1308930694.54896 172.16.238.131 80 tcp HTTP -1308930716.45795 74.125.225.81 80 tcp HTTP -1308930703.06815 172.16.238.131 21 tcp FTP -1308930726.86415 141.142.192.39 22 tcp SSH +# path:'known_services' +# separator:' ' +# ts=time host=addr port_num=port port_proto=enum service=table +1308930691.035044 172.16.238.131 22 tcp SSH +1308930694.548964 172.16.238.131 80 tcp HTTP +1308930716.457950 74.125.225.81 80 tcp HTTP +1308930703.068148 172.16.238.131 21 tcp FTP +1308930726.864150 141.142.192.39 22 tcp SSH diff --git a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-local.log b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-local.log index 9ff7eb3198..ebe040c18c 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-local.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-local.log @@ -1,4 +1,7 @@ # ts host port_num port_proto service -1308930691.03504 172.16.238.131 22 tcp SSH -1308930694.54896 172.16.238.131 80 tcp HTTP -1308930703.06815 172.16.238.131 21 tcp FTP +# path:'known_services' +# separator:' ' +# ts=time host=addr port_num=port port_proto=enum service=table +1308930691.035044 172.16.238.131 22 tcp SSH +1308930694.548964 172.16.238.131 80 tcp HTTP +1308930703.068148 172.16.238.131 21 tcp FTP diff --git a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-remote.log b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-remote.log index 1adb50ed94..cdb00e1cea 100644 --- a/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-remote.log +++ b/testing/btest/Baseline/policy.protocols.conn.known-services/knownservices-remote.log @@ -1,3 +1,6 @@ # ts host port_num port_proto service -1308930716.45795 74.125.225.81 80 tcp HTTP -1308930726.86415 141.142.192.39 22 tcp SSH +# path:'known_services' +# separator:' ' +# ts=time host=addr port_num=port port_proto=enum service=table +1308930716.457950 74.125.225.81 80 tcp HTTP +1308930726.864150 141.142.192.39 22 tcp SSH diff --git a/testing/btest/Baseline/policy.protocols.dns.event-priority/dns.log b/testing/btest/Baseline/policy.protocols.dns.event-priority/dns.log index 6a5b6c6044..b2d843b24d 100644 --- a/testing/btest/Baseline/policy.protocols.dns.event-priority/dns.log +++ b/testing/btest/Baseline/policy.protocols.dns.event-priority/dns.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name QR AA TC RD RA Z TTL answers auth addl +# path:'dns' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port proto=enum trans_id=count query=string qclass=count qclass_name=string qtype=count qtype_name=string rcode=count rcode_name=string QR=bool AA=bool TC=bool RD=bool RA=bool Z=count TTL=interval answers=table auth=table addl=table 930613226.529070 UWkUyAuUGXf 212.180.42.100 25000 131.243.64.3 53 tcp 34798 - - - - - 0 NOERROR F F F F T 0 31337.0 4.3.2.1 - - diff --git a/testing/btest/Baseline/policy.protocols.http.http-mime-and-md5/http.log b/testing/btest/Baseline/policy.protocols.http.http-mime-and-md5/http.log index ee07722d92..07649e6100 100644 --- a/testing/btest/Baseline/policy.protocols.http.http-mime-and-md5/http.log +++ b/testing/btest/Baseline/policy.protocols.http.http-mime-and-md5/http.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table mime_type=string md5=string extraction_file=file 1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 946 200 OK - - - - - FAKE_MIME - - 1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 6716 200 OK - - - - - FAKE_MIME - - 1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 94 200 OK - - - - - FAKE_MIME - - diff --git a/testing/btest/Baseline/policy.protocols.http.http-pipelining/http.log b/testing/btest/Baseline/policy.protocols.http.http-pipelining/http.log index 1c9e7eb7d6..29eeb6eed5 100644 --- a/testing/btest/Baseline/policy.protocols.http.http-pipelining/http.log +++ b/testing/btest/Baseline/policy.protocols.http.http-pipelining/http.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied md5 extraction_file +# path:'http' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port method=string host=string uri=string referrer=string user_agent=string request_content_length=count response_content_length=count status_code=count status_msg=string filename=string tags=table username=string password=string proxied=table md5=string extraction_file=file 1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 946 200 OK - - - - - - - 1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 6716 200 OK - - - - - - - 1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 94 200 OK - - - - - - - diff --git a/testing/btest/Baseline/policy.protocols.irc.basic/irc.log b/testing/btest/Baseline/policy.protocols.irc.basic/irc.log index bea67dcf5b..2d77551a78 100644 --- a/testing/btest/Baseline/policy.protocols.irc.basic/irc.log +++ b/testing/btest/Baseline/policy.protocols.irc.basic/irc.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user channels command value addl tags dcc_file_name dcc_file_size extraction_file +# path:'irc' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port nick=string user=string channels=table command=string value=string addl=string tags=table dcc_file_name=string dcc_file_size=count extraction_file=file 1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 - - - NICK bloed - - - - - 1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed - - USER sdkfje sdkfje Montreal.QC.CA.Undernet.org dkdkrwq - - - - 1311189174.474127 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje - JOIN #easymovies - - - - - diff --git a/testing/btest/Baseline/policy.protocols.irc.dcc-extract/irc.log b/testing/btest/Baseline/policy.protocols.irc.dcc-extract/irc.log index fcb002698e..863016e969 100644 --- a/testing/btest/Baseline/policy.protocols.irc.dcc-extract/irc.log +++ b/testing/btest/Baseline/policy.protocols.irc.dcc-extract/irc.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user channels command value addl tags dcc_file_name dcc_file_size dcc_mime_type extraction_file +# path:'irc' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port nick=string user=string channels=table command=string value=string addl=string tags=table dcc_file_name=string dcc_file_size=count dcc_mime_type=string extraction_file=file 1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 - - - NICK bloed - - - - - - 1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed - - USER sdkfje sdkfje Montreal.QC.CA.Undernet.org dkdkrwq - - - - - 1311189174.474127 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje - JOIN #easymovies - - - - - - diff --git a/testing/btest/Baseline/policy.protocols.smtp.basic/smtp.log b/testing/btest/Baseline/policy.protocols.smtp.basic/smtp.log index ea638d1892..bdb5a1fe1c 100644 --- a/testing/btest/Baseline/policy.protocols.smtp.basic/smtp.log +++ b/testing/btest/Baseline/policy.protocols.smtp.basic/smtp.log @@ -1,2 +1,5 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid helo mailfrom rcptto date from to reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent +# path:'smtp' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port mid=string helo=string mailfrom=string rcptto=table date=string from=string to=table reply_to=string msg_id=string in_reply_to=string subject=string x_originating_ip=addr first_received=string second_received=string last_reply=string path=vector user_agent=string 1254722768.219663 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh GP Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0 diff --git a/testing/btest/Baseline/policy.protocols.smtp.mime-extract/smtp_entities.log b/testing/btest/Baseline/policy.protocols.smtp.mime-extract/smtp_entities.log index 9496887d65..4fd0d42f6f 100644 --- a/testing/btest/Baseline/policy.protocols.smtp.mime-extract/smtp_entities.log +++ b/testing/btest/Baseline/policy.protocols.smtp.mime-extract/smtp_entities.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt +# path:'smtp_entities' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port mid=string filename=string content_len=count mime_type=string md5=string extraction_file=file excerpt=string 1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 79 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat - 1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 1918 FAKE_MIME - - - 1254722770.692804 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh NEWS.txt 10823 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_2.dat - diff --git a/testing/btest/Baseline/policy.protocols.smtp.mime/smtp_entities.log b/testing/btest/Baseline/policy.protocols.smtp.mime/smtp_entities.log index 2b143eacda..a89e3248e8 100644 --- a/testing/btest/Baseline/policy.protocols.smtp.mime/smtp_entities.log +++ b/testing/btest/Baseline/policy.protocols.smtp.mime/smtp_entities.log @@ -1,4 +1,7 @@ # ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt +# path:'smtp_entities' +# separator:' ' +# ts=time uid=string id.orig_h=addr id.orig_p=port id.resp_h=addr id.resp_p=port mid=string filename=string content_len=count mime_type=string md5=string extraction_file=file excerpt=string 1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 79 FAKE_MIME 92bca2e6cdcde73647125da7dccbdd07 - - 1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 1918 FAKE_MIME - - - 1254722770.692804 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh NEWS.txt 10823 FAKE_MIME a968bb0f9f9d95835b2e74c845877e87 - -