mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
9c6402bd91
- Actually get the path into the smb_files.log now. - When a share root is having the "create" message used on it, instead of giving a null file name, now give a special indicator of "<share_root>". - Update test baselines.
13 lines
1.1 KiB
Text
13 lines
1.1 KiB
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path smb_files
|
|
#open 2016-03-09-09-45-49
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size times.modified times.accessed times.created times.changed
|
|
#types time string addr port addr port string enum string string count time time time time
|
|
1403194573.483536 CXWv6p3arKYeMETxOg 192.168.1.78 55770 192.168.1.53 445 - SMB::UNKNOWN_OPEN - <share_root> 0 1403193605.830790 1403193605.830790 1403193211.405449 1403193605.830790
|
|
1403194573.484701 CXWv6p3arKYeMETxOg 192.168.1.78 55770 192.168.1.53 445 - SMB::UNKNOWN_OPEN - Test 0 1403193632.973276 1403193632.973276 1403193604.628965 1403193632.973276
|
|
1403194574.150293 CXWv6p3arKYeMETxOg 192.168.1.78 55770 192.168.1.53 445 - SMB::UNKNOWN_OPEN - Test\\2009-12 Payroll.xlsx 25940 1403148950.000000 1403193623.046524 1403148950.000000 1403193632.973276
|
|
1403194574.232191 CXWv6p3arKYeMETxOg 192.168.1.78 55770 192.168.1.53 445 FyxE5A19VJyangfN54 SMB::UNKNOWN_OPEN - Test\\2009-12 Payroll.xlsx 25940 1403148950.000000 1403193623.046524 1403148950.000000 1403193632.973276
|
|
#close 2016-03-09-09-45-49
|