zeek/testing/btest/Baseline/policy.frameworks.logging.ascii-empty/ssh.log
Gilbert Clark gc355804@ohio.edu b723ecd0e0 Header modification to LogWriterAscii to make it easier for scripts to
understand bro log files.
2011-08-13 21:10:51 -07:00

9 lines
526 B
Text

PREFIX<>t|id.orig_h|id.orig_p|id.resp_h|id.resp_p|status|country|b
PREFIX<>path:'ssh'
PREFIX<>separator:'|'
PREFIX<>t=time|id.orig_h=addr|id.orig_p=port|id.resp_h=addr|id.resp_p=port|status=string|country=string|b=bool
1313294759.195743|1.2.3.4|1234|2.3.4.5|80|success|unknown|NOT-SET
1313294759.195743|1.2.3.4|1234|2.3.4.5|80|NOT-SET|US|NOT-SET
1313294759.195743|1.2.3.4|1234|2.3.4.5|80|failure|UK|NOT-SET
1313294759.195743|1.2.3.4|1234|2.3.4.5|80|NOT-SET|BR|NOT-SET
1313294759.195743|1.2.3.4|1234|2.3.4.5|80|failure|EMPTY|T