audit_log_parser 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0202a0ebca9afb91aba76841cc3bf2907112c90fed14b0301cf59012ebcc1678
-  data.tar.gz: a6266d08657b1f5ba0a24d6127a5043e08eef71355584910c9c91ea1f29844e2
+  metadata.gz: 44f1c148dffdd203d11a2d99dabf9f4a6c61a1d054a88d445a0da9f5e35cca65
+  data.tar.gz: c2abf7e7037a5dab5fabbaaf2226c5e70ee57b3804a116cfc61a2a9186a8a9a4
 SHA512:
-  metadata.gz: 630ce72caaffc1dd3e0dd09a1985a53a85e48dfabdc8554218c59e5a2ae7509af5ea425e76238369520113e35ba53f1d25907d447a4318af10bc5f29fdf186d3
-  data.tar.gz: 5c50af811818572d925753b44956e5d3b868dc51e7bf45184833534002c0aa163132b8d47df63828d60fa99f8d385b5fbc33cc133778a6200a7001e9cc3dc121
+  metadata.gz: ce9037c3ac30c6853f173159bb062a9994bb88e056fc1605e0698ab87a2658cb7a8c1b8fda332715b102d24292dad4e4e422f8e8da6709d098c97d64d56d0594
+  data.tar.gz: 83610302f7adb5450abf919fbf6363127739bd7128ea6c7ab4c5373557ca9a7ac9f2cfe9d714e869a7f0f7f194156a4e80c8c1198a8c5cab8b09ac5bcd3d86aa

data/README.md

@@ -28,11 +28,11 @@ Or install it yourself as:
 require 'audit_log_parser'
 require 'pp'
 
-audit_log = <<EOS
+audit_log1 = <<EOS
 type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="cat" exe="/bin/cat" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="sshd_config"
 EOS
 
-pp AuditLogParser.parse(data)
+pp AuditLogParser.parse_line(audit_log1)
 #=> {"header"=>{"type"=>"SYSCALL", "msg"=>"audit(1364481363.243:24287)"},
 #    "body"=>
 #     {"arch"=>"c000003e",
@@ -61,4 +61,25 @@ pp AuditLogParser.parse(data)
 #      "exe"=>"\"/bin/cat\"",
 #      "subj"=>"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023",
 #      "key"=>"\"sshd_config\""}}
+
+audit_log2 = <<EOS
+type=USER_AUTH msg=audit(1364475353.159:24270): user pid=3280 uid=500 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=failed'
+EOS
+
+pp AuditLogParser.parse_line(audit_log2)
+#=> {"header"=>{"type"=>"USER_AUTH", "msg"=>"audit(1364475353.159:24270)"},
+#    "body"=>
+#     {"user pid"=>"3280",
+#      "uid"=>"500",
+#      "auid"=>"500",
+#      "ses"=>"1",
+#      "subj"=>"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023",
+#      "msg"=>
+#       {"op"=>"PAM:authentication",
+#        "acct"=>"\"root\"",
+#        "exe"=>"\"/bin/su\"",
+#        "hostname"=>"?",
+#        "addr"=>"?",
+#        "terminal"=>"pts/0",
+#        "res"=>"failed"}}}
 ```

data/lib/audit_log_parser/version.rb

@@ -1,3 +1,3 @@
 class AuditLogParser
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

data/lib/audit_log_parser.rb

@@ -67,7 +67,7 @@ class AuditLogParser
       when "'"
         nest = ss.scan_until(/'/)
         nest.chomp!("'")
-        value = nest
+        value = parse_body(nest)
       else
         value << ss.scan_until(/( |\z)/)
         value.chomp!(' ')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: audit_log_parser
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - winebarrel