python-logsparser 0.4-1 / usr / share / logsparser / normalizers / dhcpd.xml

This file is indexed.

/usr/share/logsparser/normalizers/dhcpd.xml is in python-logsparser 0.4-1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below. 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
<?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!--                                                            -->
<!-- pylogparser - Logs parsers python library                  -->
<!-- Copyright (C) 2011 Wallix Inc.                             -->
<!--                                                            -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!--                                                            -->
<!-- This package is free software; you can redistribute        -->
<!-- it and/or modify it under the terms of the GNU Lesser      -->
<!-- General Public License as published by the Free Software   -->
<!-- Foundation; either version 2.1 of the License, or (at      -->
<!-- your option) any later version.                            -->
<!--                                                            -->
<!-- This package is distributed in the hope that it will be    -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR    -->
<!-- PURPOSE.  See the GNU Lesser General Public License for    -->
<!-- more details.                                              -->
<!--                                                            -->
<!-- You should have received a copy of the GNU Lesser General  -->
<!-- Public License along with this package; if not, write      -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place,    -->
<!-- Suite 330, Boston, MA  02111-1307  USA                     -->
<!--                                                            -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="DHCPd"
            version="0.99"
            unicode="yes"
            ignorecase="yes"
            matchtype="match"
            appliedTo="body"
            taxonomy="address assignation">
    <description>
        <localized_desc language="en">This normalizer is used to parse DHCPd messages.</localized_desc>
        <localized_desc language="fr">Ce normaliseur analyse les messages émis par les serveurs DHCPd.</localized_desc></description>
    <authors>
        <author>mhu@wallix.com</author>
    </authors>
    <tagTypes>
        <tagType name="AnythingWithoutSpace" type="basestring">
            <description>
        <localized_desc language="en">Expression matching a single word or lexeme.</localized_desc>
        <localized_desc language="fr">Expression correspondant à un mot sans espace intersticiel.</localized_desc></description>
            <regexp>[^ ]+</regexp>
        </tagType>
        <tagType name="DHCPAction" type="basestring">
            <description>
        <localized_desc language="en">Expression matching the action notified by the DCHP daemon.</localized_desc>
        <localized_desc language="fr">Expression correspondant à l'action DHCP.</localized_desc></description>
            <regexp>DHCP[A-Z]+</regexp>
        </tagType>
    </tagTypes>
    <callbacks>
        <callback name="decode_action">
log["action"] = value[4:]
        </callback>
    </callbacks>
    <patterns>
        <pattern name="DHCPd-001-DISCOVER">
            <description>
        <localized_desc language="en">Generic DHCP discovery message.</localized_desc>
        <localized_desc language="fr">Structure générique d'un message de découverte DHCP.</localized_desc></description>
            <text>DHCPACTION from MACADDRESS via ADDRESS</text>
            <tags>
                <tag name="__dhcpaction" tagType="DHCPAction">
                    <substitute>DHCPACTION</substitute>
                    <callbacks>
                        <callback>decode_action</callback>
                    </callbacks>
                </tag>
                <tag name="source_mac" tagType="MACAddress">
                    <substitute>MACADDRESS</substitute>
                </tag>
                <tag name="via" tagType="AnythingWithoutSpace">
                    <substitute>ADDRESS</substitute>
                </tag>
            </tags>
            <examples>
                <example>
                    <text>DHCPDISCOVER from 02:1c:25:a3:32:76 via 183.213.184.122</text>
                    <expectedTags>
                        <expectedTag name="action">DISCOVER</expectedTag>
                        <expectedTag name="source_mac">02:1c:25:a3:32:76</expectedTag>
                        <expectedTag name="via">183.213.184.122</expectedTag>
                        <expectedTag name="taxonomy">address assignation</expectedTag>
                    </expectedTags>
                </example>
            </examples>
        </pattern>
        <pattern name="DHCPd-002-INFORM">
            <description>
        <localized_desc language="en">Generic DHCP inform message.</localized_desc>
        <localized_desc language="fr">Message générique informatif.</localized_desc></description>
            <text>DHCPACTION from IP</text>
            <tags>
                <tag name="__dhcpaction" tagType="DHCPAction">
                    <substitute>DHCPACTION</substitute>
                    <callbacks>
                        <callback>decode_action</callback>
                    </callbacks>
                </tag>
                <tag name="source_ip" tagType="IP">
                    <substitute>IP</substitute>
                </tag>
            </tags>
            <examples>
                <example>
                    <text>DHCPINFORM from 183.231.184.122</text>
                    <expectedTags>
                        <expectedTag name="action">INFORM</expectedTag>
                        <expectedTag name="source_ip">183.231.184.122</expectedTag>
                        <expectedTag name="taxonomy">address assignation</expectedTag>
                    </expectedTags>
                </example>
            </examples>
        </pattern>
        <pattern name="DHCPd-003-OTHERACTIONS">
            <description>
        <localized_desc language="en">Other DHCP messages : offer, request, acknowledge, non-acknowledge, decline, release.</localized_desc>
        <localized_desc language="fr">Autres messages DHCP : offre de bail, requête, confirmation, réfutation, refus, libération de bail.</localized_desc></description>
            <text>DHCPACTION [a-z]+ IP [a-z]+ MACADDRESS via VIA</text>
            <tags>
                <tag name="__dhcpaction" tagType="DHCPAction">
                    <substitute>DHCPACTION</substitute>
                    <callbacks>
                        <callback>decode_action</callback>
                    </callbacks>
                </tag>
                <tag name="source_ip" tagType="IP">
                    <substitute>IP</substitute>
                </tag>
                <tag name="source_mac" tagType="MACAddress">
                    <substitute>MACADDRESS</substitute>
                </tag>
                <tag name="via" tagType="AnythingWithoutSpace">
                    <substitute>VIA</substitute>
                </tag>
            </tags>
            <examples>
                <example>
                    <text>DHCPOFFER on 183.231.184.122 to 00:13:ec:1c:06:5b via 183.213.184.122</text>
                    <expectedTags>
                        <expectedTag name="action">OFFER</expectedTag>
                        <expectedTag name="source_ip">183.231.184.122</expectedTag>
                        <expectedTag name="source_mac">00:13:ec:1c:06:5b</expectedTag>
                        <expectedTag name="via">183.213.184.122</expectedTag>
                        <expectedTag name="taxonomy">address assignation</expectedTag>
                    </expectedTags>
                </example>
                <example>
                    <text>DHCPREQUEST for 183.231.184.122 from 00:13:ec:1c:06:5b via 183.213.184.122</text>
                    <expectedTags>
                        <expectedTag name="action">REQUEST</expectedTag>
                        <expectedTag name="source_ip">183.231.184.122</expectedTag>
                        <expectedTag name="source_mac">00:13:ec:1c:06:5b</expectedTag>
                        <expectedTag name="via">183.213.184.122</expectedTag>
                        <expectedTag name="taxonomy">address assignation</expectedTag>
                    </expectedTags>
                </example>
            </examples>
        </pattern>
    </patterns>
</normalizer>

APT Browse - Built by Thomas Orozco.