/usr/share/logsparser/normalizers/UserAgent.xml is in python-logsparser 0.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 | <?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- pylogparser - Logs parsers python library -->
<!-- Copyright (C) 2011 Wallix Inc. -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- This package is free software; you can redistribute -->
<!-- it and/or modify it under the terms of the GNU Lesser -->
<!-- General Public License as published by the Free Software -->
<!-- Foundation; either version 2.1 of the License, or (at -->
<!-- your option) any later version. -->
<!-- -->
<!-- This package is distributed in the hope that it will be -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -->
<!-- PURPOSE. See the GNU Lesser General Public License for -->
<!-- more details. -->
<!-- -->
<!-- You should have received a copy of the GNU Lesser General -->
<!-- Public License along with this package; if not, write -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place, -->
<!-- Suite 330, Boston, MA 02111-1307 USA -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="UserAgent"
version="0.99"
unicode="yes"
ignorecase="yes"
matchtype="match"
appliedTo="useragent">
<description>
<localized_desc language="en">This normalizer extracts additional info from the useragent field in a HTTP request.</localized_desc>
<localized_desc language="fr">Ce normaliseur extrait des données supplémentaires des du champ useragent présent dans les requêtes HTTP.</localized_desc>
</description>
<authors>
<author>mhu@wallix.com</author>
</authors>
<callbacks>
<callback name="findBot">
m = extras.robot_regex.search(value)
if m:
log["search_engine_bot"] = m.group().lower()
</callback>
<callback name="guessOS">
known_os = {"Mac OS" : "Mac/Apple",
"Windows" : "Windows",
"Linux" : "Linux"}
guess = "unknown"
for i,j in known_os.items():
if i in value:
guess = j
break
log['source_os'] = guess
</callback>
</callbacks>
<patterns>
<pattern name="UseragentPattern">
<text>USERAGENT</text>
<tags>
<tag name="__ua" tagType="Anything">
<substitute>USERAGENT</substitute>
<callbacks>
<callback>findBot</callback>
<callback>guessOS</callback>
</callbacks>
</tag>
</tags>
<examples>
<example>
<text>Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)</text>
<expectedTags>
<expectedTag name="search_engine_bot">baiduspider</expectedTag>
<expectedTag name="source_os">unknown</expectedTag>
</expectedTags>
</example>
<example>
<text>Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10</text>
<expectedTags>
<expectedTag name="source_os">Mac/Apple</expectedTag>
</expectedTags>
</example>
<example>
<text>Nokia6680/1.0 (4.04.07) SymbianOS/8.0 Series60/2.6 Profile/MIDP-2.0 Configuration/CLDC-1.1</text>
<expectedTags>
<expectedTag name="source_os">unknown</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
</patterns>
</normalizer>
|