python-logsparser 0.4-1 / usr / share / logsparser / normalizers / pam.xml

This file is indexed.

/usr/share/logsparser/normalizers/pam.xml is in python-logsparser 0.4-1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below. 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
<?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!--                                                            -->
<!-- pylogparser - Logs parsers python library                  -->
<!-- Copyright (C) 2011 Wallix Inc.                             -->
<!--                                                            -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!--                                                            -->
<!-- This package is free software; you can redistribute        -->
<!-- it and/or modify it under the terms of the GNU Lesser      -->
<!-- General Public License as published by the Free Software   -->
<!-- Foundation; either version 2.1 of the License, or (at      -->
<!-- your option) any later version.                            -->
<!--                                                            -->
<!-- This package is distributed in the hope that it will be    -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR    -->
<!-- PURPOSE.  See the GNU Lesser General Public License for    -->
<!-- more details.                                              -->
<!--                                                            -->
<!-- You should have received a copy of the GNU Lesser General  -->
<!-- Public License along with this package; if not, write      -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place,    -->
<!-- Suite 330, Boston, MA  02111-1307  USA                     -->
<!--                                                            -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="PAM"
            version="0.99"
            unicode="yes"
            ignorecase="yes"
            matchtype="match"
            appliedTo="body"
            taxonomy="access control">
    <description>
        <localized_desc language="en">This normalizer can parse messages issued by the Pluggable Authentication Module (PAM).</localized_desc>
        <localized_desc language="fr">Ce normaliseur analyse les messages émis par le module d'authentification par greffons (PAM).</localized_desc></description>
    <authors>
        <author>mhu@wallix.com</author>
    </authors>
    <tagTypes>
        <tagType name="PAMComponent" type="basestring">
            <description>
        <localized_desc language="en">the name of the PAM component</localized_desc>
        <localized_desc language="fr">le nom du composant PAM</localized_desc></description>
            <regexp>pam_\w+</regexp>
        </tagType>
        <tagType name="PAMUser" type="basestring">
            <description>
        <localized_desc language="en">the user information</localized_desc>
        <localized_desc language="fr">l'utilisateur concerné par l'authentification</localized_desc></description>
            <regexp>[^ ]+</regexp>
        </tagType>
        <tagType name="PAMSession" type="basestring">
            <description>
        <localized_desc language="en">the session action</localized_desc>
        <localized_desc language="fr">l'action de session</localized_desc></description>
            <regexp>opened|closed</regexp>
        </tagType>
    </tagTypes>
    <callbacks>
        <callback name="decode_action">
log["action"] = {'opened' : 'open',
                 'closed' : 'close'}.get(value, value)</callback>
    </callbacks>
    <patterns>
        <pattern name="PAM-001-session">
            <description>
        <localized_desc language="en">This type of message is logged at session opening or closing.</localized_desc>
        <localized_desc language="fr">Structure des message émis à l'ouverture ou la fermeture de session.</localized_desc></description>
            <text>PAMCOMPONENT\(PROGRAM:TYPE\):.* session ACTION for user USER</text>
            <tags>
                <tag name="component" tagType="PAMComponent">
                 <description>
        <localized_desc language="en">the PAM component</localized_desc>
        <localized_desc language="fr">le composant PAM</localized_desc></description>
                 <substitute>PAMCOMPONENT</substitute>
                </tag>
                <tag name="program" tagType="Anything">
                 <description>
        <localized_desc language="en">the program calling PAM</localized_desc>
        <localized_desc language="fr">le programme invoquant l'authentification via PAM</localized_desc></description>
                 <substitute>PROGRAM</substitute>
                </tag>
                <tag name="type" tagType="Anything">
                 <description>
        <localized_desc language="en">the authentication type</localized_desc>
        <localized_desc language="fr">le type d'authentification</localized_desc></description>
                 <substitute>TYPE</substitute>
                </tag>
                <tag name="action" tagType="PAMSession">
                 <description>
        <localized_desc language="en">the action taken regarding the session</localized_desc>
        <localized_desc language="fr">l'action associée à la session</localized_desc></description>
                 <substitute>ACTION</substitute>
                 <callbacks>
                  <callback>decode_action</callback>
                 </callbacks>
                </tag>
                <tag name="user" tagType="PAMUser">
                 <description>
        <localized_desc language="en">the user for which an authentication request is issued</localized_desc>
        <localized_desc language="fr">l'utilisateur pour lequel la demande d'authentification est émise</localized_desc></description>
                 <substitute>USER</substitute>
                </tag>
            </tags>
            <examples>
                <example>
                     <text>pam_unix(cron:session): session opened for user www-data by (uid=0)</text>
                     <expectedTags>
                          <expectedTag name="program">cron</expectedTag>
                          <expectedTag name="component">pam_unix</expectedTag>
                          <expectedTag name="type">session</expectedTag>
                          <expectedTag name="action">open</expectedTag>
                          <expectedTag name="user">www-data</expectedTag>
                          <expectedTag name="taxonomy">access control</expectedTag>
                     </expectedTags>
                </example>
            </examples>
        </pattern>
        <pattern name="PAM-002-generic">
            <description>
        <localized_desc language="en">A generic PAM message.</localized_desc>
        <localized_desc language="fr">Structure générique des messages PAM non relatifs à une ouverture ou fermeture de session.</localized_desc></description>
            <text>PAMCOMPONENT\(PROGRAM:TYPE\):.* (?:user=USER)?</text>
            <tags>
                <tag name="component" tagType="PAMComponent">
                 <description>
        <localized_desc language="en">the PAM component</localized_desc>
        <localized_desc language="fr">le composant PAM</localized_desc></description>
                 <substitute>PAMCOMPONENT</substitute>
                </tag>
                <tag name="program" tagType="Anything">
                 <description>
        <localized_desc language="en">the program calling PAM</localized_desc>
        <localized_desc language="fr">le programme invoquant l'authentification via PAM</localized_desc></description>
                 <substitute>PROGRAM</substitute>
                </tag>
                <tag name="type" tagType="Anything">
                 <description>
        <localized_desc language="en">the authentication type</localized_desc>
        <localized_desc language="fr">le type d'authentification</localized_desc></description>
                 <substitute>TYPE</substitute>
                </tag>
                <tag name="user" tagType="PAMUser">
                 <description>
        <localized_desc language="en">the user for which an authentication request is issued</localized_desc>
        <localized_desc language="fr">l'utilisateur pour lequel la demande d'authentification est émise</localized_desc></description>
                 <substitute>USER</substitute>
                </tag>
            </tags>
        </pattern>
    </patterns>
</normalizer>

APT Browse - Built by Thomas Orozco.