dissect.target 3.20.2.dev53__tar.gz → 3.20.2.dev55__tar.gz

{dissect_target-3.20.2.dev53/dissect.target.egg-info → dissect_target-3.20.2.dev55}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev53
+Version: 3.20.2.dev55
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55}/dissect/target/helpers/configutil.py

@@ -726,7 +726,7 @@ class SystemD(Indentation):
     ) -> bool:
         scope_char = ("[", "]")
         changed = False
-        if line.startswith(scope_char):
+        if line.lstrip().startswith(scope_char):
             if not manager.is_root():
                 changed = manager.pop()
             stripped_characters = "".join(scope_char)

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55}/dissect/target/plugins/os/unix/linux/services.py

@@ -2,6 +2,7 @@ from itertools import chain
 from typing import Iterator
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.helpers import configutil
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export, internal
 
@@ -58,10 +59,13 @@ class ServicesPlugin(Plugin):
                     continue
 
                 try:
-                    parsed_file = self.target.config_tree(service_file, as_dict=True)
+                    parsed_config = configutil.parse(service_file, hint="systemd")
                     config = {}
                     types = []
-                    for segment, configuration in parsed_file.items():
+                    for segment, configuration in parsed_config.items():
+                        if not configuration:
+                            continue
+
                         for key, value in configuration.items():
                             _value = value or None
                             _key = f"{segment}_{key}"

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55}/dissect/target/plugins/os/unix/log/helpers.py

@@ -15,9 +15,9 @@ RE_TS_ISO = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}\+\d{2}:\d{2
 RE_LINE = re.compile(
     r"""
     \d{2}:\d{2}\s                           # First match on the similar ending of the different timestamps
-    (?:\S+)\s                               # The hostname, but do not capture it
-    (?P<service>\S+?)(\[(?P<pid>\d+)\])?:    # The service / daemon with optionally the PID between brackets
-    \s*(?P<message>.+?)\s*$                 # The log message stripped from spaces left and right
+    ((?:\S+)\s)?                            # The hostname (optional), but do not capture it
+    (?P<service>\S+?)(\[(?P<pid>\d+?)\])?:  # The service / daemon with optionally the PID between brackets
+    (\s*(?P<message>.+?)\s*)?$              # The log message stripped from spaces left and right
     """,
     re.VERBOSE,
 )

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55}/dissect/target/plugins/os/unix/log/messages.py

@@ -87,8 +87,7 @@ class MessagesPlugin(Plugin):
                 match = RE_LINE.search(line)
 
                 if not match:
-                    self.target.log.warning("Unable to parse message line in %s", log_file)
-                    self.target.log.debug("Line %s", line)
+                    self.target.log.warning("Unable to parse message line in %s: %r", log_file, line)
                     continue
 
                 yield MessagesRecord(

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev53
+Version: 3.20.2.dev55
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev53 → dissect_target-3.20.2.dev55}/tests/plugins/os/unix/log/test_messages.py

@@ -107,6 +107,12 @@ def test_unix_log_messages_malformed_log_year_rollover(target_unix_users: Target
         results = list(target_unix_users.messages())
         assert len(results) == 2
 
+        assert results[0].ts
+        assert results[0].service == "systemd"
+        assert results[0].pid == 1
+        assert results[0].message == "Starting Journal Service..."
+        assert results[0].source == "/var/log/messages"
+
 
 def test_unix_messages_cloud_init(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
     """test if we correctly parse plaintext and compressed cloud-init log files."""
@@ -165,3 +171,33 @@ def test_unix_messages_ts_iso_8601_format(target_unix: Target, fs_unix: VirtualF
     assert results[0].ts == datetime(2024, 12, 31, 11, 37, 0, 123456, tzinfo=timezone.utc)
     assert results[0].message == "Started anacron.service - Run anacron jobs."
     assert results[0].source == "/var/log/syslog.1"
+
+
+def test_linux_messages_kernel_logs(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we can parse kernel ring buffer messages."""
+
+    messages = """
+    Dec 31 13:37:01 hostname kernel: [1337.1337] some example message
+    Jan  1 13:37:02 kernel: [    0.000000] x86/fpu: Supporting feature 0x1337: 'message'
+    Jan  2 13:37:03 kernel: [    0.000000] x86/fpu: state[1337]:  1337, size[1337]:   1337
+    Jan  3 13:37:04 kernel:
+    """
+
+    fs_unix.map_file_fh("/var/log/installer/syslog.1", BytesIO(gzip.compress(textwrap.dedent(messages).encode())))
+    target_unix.add_plugin(UnixPlugin)
+    target_unix.add_plugin(MessagesPlugin)
+
+    results = sorted(list(target_unix.syslog()), key=lambda r: r.ts)
+    assert len(results) == 4
+
+    assert results[0].service == "kernel"
+    assert results[0].message == "[1337.1337] some example message"
+
+    assert results[1].service == "kernel"
+    assert results[1].message == "[    0.000000] x86/fpu: Supporting feature 0x1337: 'message'"
+
+    assert results[2].service == "kernel"
+    assert results[2].message == "[    0.000000] x86/fpu: state[1337]:  1337, size[1337]:   1337"
+
+    assert results[3].service == "kernel"
+    assert results[3].message is None