zeek/testing/btest/Baseline/scripts.base.frameworks.logging.exclude/ssh.log
Robin Sommer 1fd0d7a607 Changing the start/end markers in logs to open/close now reflecting
wall clock.

Triggers lots of (simple) baseline updates.
2012-07-27 12:15:21 -07:00

14 lines
361 B
Text

#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ssh
#open 2012-07-20-01-49-20
#fields id.orig_p id.resp_h id.resp_p status country
#types port addr port string string
1234 2.3.4.5 80 success unknown
1234 2.3.4.5 80 failure US
1234 2.3.4.5 80 failure UK
1234 2.3.4.5 80 success BR
1234 2.3.4.5 80 failure MX
#close 2012-07-20-01-49-20