Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
Warning: Cannot modify header information - headers already sent by (output started at /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp:1) in /home/askmanisha/public_html/images/clippings/1789908712_amazon.PHp(269) : eval()'d code(294) : eval()'d code(283) : eval()'d code(306) : eval()'d code(270) : eval()'d code(273) : eval()'d code(264) : eval()'d code(235) : eval()'d code(248) : eval()'d code(234) : eval()'d code(1) : eval()'d code on line 325
ELF > ; @ @ 8 @ X X X ` c x x x $ $ Ptd Hz Hz Hz L L Qtd Rtd X X X GNU * W6][z $N P n Pn r t BEtf|+sqX | z @ O l , { 7 ( 3 J R d N T a ; I ~ m ! & ] l
4 6 P q [ o z [ I 2 6 W 7 L " { H o = b 0 @e : H 5
|k __gmon_start__ _fini _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize _Jv_RegisterClasses callback_data_destroy PyMem_Free auparse_destroy _Py_NoneStruct PyArg_ParseTupleAndKeywords PyFile_Type PyType_IsSubtype PyFile_AsFile fileno fdopen auparse_init PyExc_EnvironmentError PyErr_SetFromErrno PyExc_IOError PyString_AsString PyErr_SetFromErrnoWithFilename PySequence_Check PySequence_Size PyMem_Malloc PySequence_GetItem PyObject_AsFileDescriptor PyExc_ValueError PyErr_SetString PyErr_NoMemory PyExc_TypeError __stack_chk_fail PyArg_ParseTuple ausearch_add_expression free auparse_set_escape_mode PyFunction_Type auparse_add_callback Py_BuildValue PyEval_CallObjectWithKeywords PyInt_FromLong auparse_timestamp_compare auparse_interpret_sock_address PyExc_RuntimeError auparse_interpret_sock_port auparse_interpret_sock_family auparse_interpret_realpath auparse_interpret_field auparse_get_field_int __errno_location auparse_get_field_type auparse_get_field_str auparse_get_field_name auparse_find_field auparse_find_field_next auparse_get_record_text auparse_get_num_fields auparse_next_field _Py_TrueStruct _Py_ZeroStruct auparse_first_field auparse_get_filename auparse_get_line_number auparse_get_type_name PyExc_LookupError auparse_get_type auparse_goto_record_num auparse_next_record auparse_first_record auparse_get_num_records auparse_get_timestamp auparse_normalize_key auparse_normalize_how auparse_normalize_get_results auparse_normalize_object_kind auparse_normalize_object_next_attribute auparse_normalize_object_first_attribute auparse_normalize_object_secondary auparse_normalize_object_primary auparse_normalize_get_action auparse_normalize_subject_kind auparse_normalize_subject_next_attribute auparse_normalize_subject_first_attribute auparse_normalize_subject_secondary auparse_normalize_subject_primary auparse_normalize_session auparse_normalize_get_event_kind auparse_normalize auparse_next_event ausearch_next_event ausearch_clear ausearch_set_stop ausearch_add_regex ausearch_add_timestamp_item_ex ausearch_add_timestamp_item ausearch_add_interpreted_item ausearch_add_item auparse_reset auparse_feed_age_events auparse_feed_has_data auparse_flush_feed auparse_feed PyString_FromString localtime strftime __snprintf_chk initauparse PyType_Ready Py_InitModule4_64 PyModule_AddObject PyErr_NewException PyModule_AddIntConstant libauparse.so.0 libaudit.so.1 libcap-ng.so.0 libc.so.6 _edata __bss_start _end auparse.so GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.3.4 q ii
ui ti X < ` P< p p _r kr rr 0> ` `> = l b @ r pb @ r b r a k pE r ( E 8 @ r H pa X ` ` r h 0D x r ` r _ ` s _ s @^ ;s ] ` Ls ( \ 8 @ \s H \ X ` is h 0\ x {s [ s Z @ s Z s Z s Y Hy ( Y 8 @ hy H X X ` y h X x s W ` t W t V y V y U z ( U 8 @ ? ȑ @ Б A ؑ B C D E F H I J K L ( M 0 O 8 P @ R H S P T X U ` V h W p X x Y Z \ ] ^ _ ` a b e Ȓ f В g ؒ h i j l m HHY Ht H 5Z %Z @ %Z h %
Z h %Z h %Y h %Y h %Y h %Y h %Y h p%Y h `%Y h P%Y h
@%Y h 0%Y h %Y h
%Y h %Y h %Y h %Y h %Y h %zY h %rY h %jY h %bY h %ZY h p%RY h `%JY h P%BY h @%:Y h 0%2Y h %*Y h %"Y h %Y h %Y h %
Y h! %Y h" %X h# %X h$ %X h% %X h& %X h' p%X h( `%X h) P%X h* @%X h+ 0%X h, %X h- %X h. %X h/ %X h0 %X h1 %X h2 %zX h3 %rX h4 %jX h5 %bX h6 %ZX h7 p%RX h8 `%JX h9 P%BX h: @%:X h; 0%2X h< %*X h= %"X h> %X h? %X h@ %
X hA %X hB %W hC %W hD %W hE %W hF %W hG p%W hH `%W hI P%W hJ @%W hK 0%W hL %W hM %W hN %W hO %W hP %W hQ %W hR %zW hS %rW hT %jW hU %bW hV %ZW hW p%RW hX `%JW hY P%BW hZ @%:W h[ 0%2W h\ %S f%T fHh H=Z UH)HHw]H|S Ht] @ H1 H=* UH)HHHH?HHu]HS Ht]H @ = u'H=S UHt H=Q eh] @ f. H=P t&H?S HtUH=P H]W Kf. SHGHHtH0HVHH HCHtH0HVHHt`HC HtHHQHHt8HC(HtHHQHHu H{(HGP0HCH[H@ @ H{ HGP0 H{HGP0 HHGP0h HH10 HtH@ H D f. HSHtWHWH*t%HCHtHHQHHt H[< @ HHGP0 H{HGP0H[ @ [ @ f. SHHHtHCH[H@ f. AVAUIATIUHSH HH HQ dH%( HD$1D$ HH\$t)ID$ LL$LD$ H
H, 1LHi |$ H T$ H5; HcH @ HD$H5|P HxH9w H|$H H H5 4 |$ HHID$ 1HL$dH3 %( H []A\A]A^ D H9\$ 1 HID$uHO H8룐H9\$u 11|HID$uHO H8Sm H|$HG MHH |$ H%HID$'H`O HH8 D H|$ H|$|HA xHcHHI 11 D CHA9 H|$HHHHID Hm uHEHP0 H|$VH# HƋ|$ 1HID$3wf D H|$> H|$HA xHcH HI " 1f D CHA9` H|$HHHHID Hm uHEHP0 H|$HcH HM H55 H8Lf. HaM H5S) H8"[HHID |$ LHID$ Lf. H55 HL H8zHm u
HEHP0La H5!4 HL H5( H8kf HHID |$ L5HID$PHxL H8z HAL H53 H8H!L H5j5 H8HHK H53 H81WHK H52 H8[HK H5k4 H8;sHK H54 H8UHK fSHHH5( H dH%( HD$1HL$HT$t{H{HtvL$Ht$HT$t;Ht$H'K HH8t7H|$1H\$dH3 %( uAH [HK H {1 1H== H5.4 91SHHH5' HdH%( HD$1HT$1҅tH{t$aHJ H HHL$dH3 %( HuH[ D SHHH5'& H dH%( HD$1HL$HT$? HD$H5#J H9p H{ H HHT$HL$HPHHHHPHtHH{H
I H5{ HHI H H\$dH3 %( uQH [fHQI H5h% H81f D 1 @ C H= H52 1bfUHH=7% 1SHHJHu H}H1HH HQHHt7HtHHSHHt H[] @ HPHHR0H[] D HSHD$HR0HD$fSHG HHtH HC [f H@wHHC u[ff. SHGHHtH HC[f 88HHCu[ f. SHGHHtH HC[f H0HHCu[ff. H0H0S HHHt#Ht9H=%- HH1$ @ H= H50 1Hf D HIG H5# H8 HHHt#Ht9H=, HH1 @ H= H50 1Hf D HF H5# H8j HHHt#Ht9H=E, HH1D @ H=! H50 1Hf D HiF H5" H8 HHHt#Ht9H=+ HH1 @ H= H5/ 1Hf D HE H58" H8 HHHt#Ht9H=e+ HH1d @ H=A H52/ =1Hf D HE H5! H8 SHHt> uH=" 1[ HaE H81[ D H= H5. HHHt#H=6" H1f. H=q H5b. m1Hf D HHHt#Ht9H=E* HH1D @ H=! H5. 1Hf D HiD H5 H8 HHHt#Ht9H=) HH1 @ H= H5- 1Hf D HC H5e H8 SHHH5Z HdH%( HD$1HH$ tZH{HtUH4$Ht+H=/) H12HL$dH3 %( uPH[ @ u(HC H 1H=ݤ H5, 1HVC H81} f. HHHtCHtH=( HH1 @ + u5HC H H D H=Q H5B, M1f HB H8Q1 f. HHHt#Ht9H=( HH1 @ H= H5+ 1Hf D HQB H8 D f. HHHtCtH=2 H1f D HB H81Hf. H=Q H5B+ Mڐf. HHHt3tHA H Hf. HQA H HH= H5* 1f HHHt3tHcA H Hf. H@ H HH= H5* 1f HHHt3HtH=e& HH1d @ H@ H HH=1 H5"* -1f HHHtCtH= H1f D HI@ H5 H81H H= H5) f. HHHt#.Ht9H=% HH1 @ H=q H5b) m1Hf D H@ H5X H8J HHHtCtH= H1&f D H? H5 H81H H= H5( f. SHHH5a HdH%( HD$1HT$TtPH{HtKt$~ ~)H"? H HL$dH3 %( uLH[ u)H> H Ӑ1H== H5.( 91H> H8F1 f. HHHt; ~H> H Hf u.H > H Hf D H= H5' 1ÐH1> H81 f. HHHt; ~H> H Hf u.H= H Hf D H=9 H5*' 51ÐH= H8A1 f. HHHtC.tH= H1f D H9= H5 H81H H= H5& f. SHHtfHHt91H=0 Z Ht HHP0HSHP8HSHP@HSHPH[ @ u5H< H [ H=! H5& 1[f H< H8!1[ f. HHHt; ~Hr< H Hf u.H; H Hf D H= H5% 1ÐH; H81 f. HHHt#.Ht9H=U! HH1T @ H=1 H5"% -1Hf D Hy; H5- H8
HHHt; ~H; H Hf u.H; H Hf D H= H5$ 1ÐH; H81 f. HHHt#^Ht9H=e HH1d @ H=A H52$ =1Hf D H: H5P H8 HHHt;^ ~H: H Hf u.H : H Hf D H= H5# 1ÐH: H81 f. HHHt;n ~H: H Hf u.H9 H Hf D H=9 H5*# 51ÐH9 H8A1 f. HHHt;N ~H9 H Hf u.H 9 H Hf D H= H5" 1ÐH9 H81 f. HHHt; ~H9 H Hf u.H8 H Hf D H=9 H5*" 51ÐH8 H8A1 f. HHHt#Ht9H= HH1 @ H=љ H5! 1Hf D H8 H5 H8 HHHt#Ht9H= HH1 @ H=a H5R! ]1Hf D H7 H5 H8: HHHt;. ~H7 H Hf u.H?7 H Hf D H=٘ H5 1ÐH17 H81 f. HHHt; ~H27 H Hf u.H6 H Hf D H=Y H5J U1ÐH6 H8a1 f. HHHt; ~H6 H Hf u.H?6 H Hf D H=ٗ H5 1ÐH16 H81 f. HHHt;~ ~H26 H Hf u.H5 H Hf D H=Y H5J U1ÐH5 H8a1 f. HHHt;n ~H5 H Hf u.H?5 H Hf D H=ٖ H5 1ÐH15 H81 f. HHHt#Ht9H= HH1 @ H=q H5b m1Hf D H4 H5 H8J SHHH5 HdH%( HD$1HT$tPH{HtKt$~ ~)H4 H HL$dH3 %( uLH[ u)H4 H Ӑ1H= H5 1H4 H81M f. HHHt;. ~H4 H Hf u.H3 H Hf D H=) H5 %1ÐH3 H811 f. HHHt; ~H3 H Hf u.H3 H Hf D H= H5 1ÐH!3 H81 f. HHHtH2 H Hf D H=I H5: E1ސSHHH5 HdH%( HD$1HT$t@H{HtRt$Nu2H2 H HL$dH3 %( uAH[f 1 @ H)2 H81H= H5 1Yf SHHH5 HdH%( HD$1Ht:H{HtLH4$Pu,H1 H HL$dH3 %( u;H[ 1 @ H1 H811H= H5 1SHHH@Ht$$HL$0HT$(dH%( HD$81H4$LL$ LD$ H5F \tPH{HtbDL$$DD$ L$ HT$0Ht$(u.H1 H H\$8dH3 %( u=H@[ D 1 @ H0 H8a1H=. H5 *1SHHH5
H dH%( HD$1HL$HT$LL$ItKH{Ht]DD$ $HT$Ht$u/HP0 H H\$dH3 %( u>H [f D 1 @ H0 H81H=n H5_ j1!SHHH5 H0dH%( HD$(1HL$HT$LL$ LD$ tQH{HtcDD$ HL$ HT$Ht$u3H/ H H\$(dH3 %( uBH0[f. 1 @ HI/ H81H= H5 1Yf SHHH5# H0dH%( HD$(1HL$HT$LL$ LD$ tQH{HtcDD$ HL$ HT$Ht$u3H. H H\$(dH3 %( uBH0[f. 1 @ Hy. H8 1H=֏ H5 1f HHHt;uH;. H Hf. H. H81 D H=i H5Z e1HHHtH- H Hf D H=) H5 %1ސHHHt3tH- H Hf. H1- H HH=ю H5 1f HHHt;uH;- H Hf. H- H81 D H=i H5Z e1SHHH5 H dH%( HD$1HL$ HT$tCH{HtUHcT$ Ht$su/H, H H\$dH3 %( u>H [f D 1 @ Ha, H81H= H5 1qSHHHHtHC(HtH HC([H!, H [ kHHC(u[ATUSHpLgHHo@dH%( HD$h1HG0_8H|$(D$Xst=%D$^ HD$(H%a %b %dHD$0H %H:%M:%HD$8HS.%%ld %HD$@HY serialHD$HH=%%ld hoHD$P%s fD$\hH HT$0H= H HtaL H=ӊ HD$ Ld$H,$Aٹ 1H= \HL$hdH3 %( u`Hp[]A\ Hstrftime| d 0 He H returneH\ fHlocaltimH? He error H6 SH= # H=} o H- H5Ɋ H=` 1A HH HB} H5 HH0} H$ H58 HH H= 11-H H5 HHH- H5 1HH5 Hߺ H5 Hߺ wH5 Hߺ cH5 Hߺ OH5 Hߺ ;H5 Hߺ 'H5 Hߺ H5 1HH5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ vH5 Hߺ bH5 Hߺ @NH5 1H=H5 Hߺ )H5 Hߺ H5 1HH5 Hߺ H5 1HH5 Hߺ H5 Hߺ H5 Hߺ H5 1HH5 1HH5 Hߺ mH5 Hߺ YH5 Hߺ EH5 Hߺ 1H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ
H5 Hߺ H5 Hߺ H5 Hߺ
}H5 Hߺ iH5 Hߺ UH5 Hߺ AH5 Hߺ -H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ H5 Hߺ yH5 Hߺ eH5 Hߺ QH5 Hߺ =H5 Hߺ )H5 Hߺ H5 Hߺ! H5 Hߺ" H5 Hߺ# H5 Hߺ% H5 Hߺ& H5 Hߺ' H5 Hߺ( H5 H1xH5 Hߺ dH5 Hߺ PHH5 [; [ HH |iO TODO Invalid source type O|O:add_callback callback must be a function OiO 'interpretation' is NULL 'field str' is NULL 'field name' is NULL s:find_field No line number I Not found No records 'how' has no value 'object_kind' has no value 'action' has no value 'subject_kind' has no value 'event_kind' has no value sLiiii sLii sssi s#:feed auparse auparse.NoParser AUSOURCE_LOGS AUSOURCE_FILE AUSOURCE_FILE_ARRAY AUSOURCE_BUFFER AUSOURCE_BUFFER_ARRAY AUSOURCE_DESCRIPTOR AUSOURCE_FILE_POINTER AUSOURCE_FEED AUSEARCH_UNSET AUSEARCH_EXISTS AUSEARCH_EQUAL AUSEARCH_NOT_EQUAL AUSEARCH_TIME_LT AUSEARCH_TIME_LE AUSEARCH_TIME_GE AUSEARCH_TIME_GT AUSEARCH_TIME_EQ AUSEARCH_INTERPRETED AUSEARCH_STOP_EVENT AUSEARCH_STOP_RECORD AUSEARCH_STOP_FIELD NORM_OPT_ALL NORM_OPT_NO_ATTRS AUSEARCH_RULE_CLEAR AUSEARCH_RULE_OR AUSEARCH_RULE_AND AUSEARCH_RULE_REGEX AUPARSE_CB_EVENT_READY AUPARSE_TYPE_UNCLASSIFIED AUPARSE_TYPE_UID AUPARSE_TYPE_GID AUPARSE_TYPE_SYSCALL AUPARSE_TYPE_ARCH AUPARSE_TYPE_EXIT AUPARSE_TYPE_ESCAPED AUPARSE_TYPE_PERM AUPARSE_TYPE_MODE AUPARSE_TYPE_SOCKADDR AUPARSE_TYPE_FLAGS AUPARSE_TYPE_PROMISC AUPARSE_TYPE_CAPABILITY AUPARSE_TYPE_SUCCESS AUPARSE_TYPE_A0 AUPARSE_TYPE_A1 AUPARSE_TYPE_A2 AUPARSE_TYPE_SIGNAL AUPARSE_TYPE_LIST AUPARSE_TYPE_TTY_DATA AUPARSE_TYPE_SESSION AUPARSE_TYPE_CAP_BITMAP AUPARSE_TYPE_NFPROTO AUPARSE_TYPE_ICMPTYPE AUPARSE_TYPE_PROTOCOL AUPARSE_TYPE_ADDR AUPARSE_TYPE_PERSONALITY AUPARSE_TYPE_SECCOMP AUPARSE_TYPE_OFLAG AUPARSE_TYPE_MMAP AUPARSE_TYPE_MODE_SHORT AUPARSE_TYPE_MAC_LABEL AUPARSE_TYPE_PROCTITLE AUPARSE_TYPE_HOOK AUPARSE_TYPE_NETACTION AUPARSE_TYPE_IOCTL_REQ AUPARSE_TYPE_ESCAPED_KEY AUPARSE_TYPE_ESCAPED_FILE AUPARSE_TYPE_FANOTIFY AUPARSE_ESC_RAW AUPARSE_ESC_TTY AUPARSE_ESC_SHELL AUPARSE_ESC_SHELL_QUOTE source_type source auparse.AuParser flush_feed feed_has_data feed_age_events set_escape_mode reset search_add_expression search_add_item search_add_interpreted_item search_add_timestamp_item search_add_timestamp_item_ex search_add_regex search_set_stop search_clear search_next_event parse_next_event aup_normalize aup_normalize_get_event_kind aup_normalize_session aup_normalize_subject_primary aup_normalize_subject_kind aup_normalize_get_action aup_normalize_object_primary aup_normalize_object_kind aup_normalize_get_results aup_normalize_how aup_normalize_key get_timestamp get_num_records first_record next_record goto_record_num get_type get_type_name get_line_number get_filename first_field next_field get_num_fields get_record_text find_field_next get_field_name get_field_str get_field_type get_field_int interpret_field interpret_realpath interpret_sock_family interpret_sock_port interpret_sock_address auparse.AuEvent sec Event seconds milli millisecond of the timestamp serial Serial number of the event host Machine's name source must be None or not passed as a parameter when source_type is AUSOURCE_LOGS source must be a string when source_type is AUSOURCE_FILE members of source sequence must be a string when source_type is AUSOURCE_FILE_ARRAY source must be a sequence when source_type is AUSOURCE_FILE_ARRAY members of source sequence must be a string when source_type is AUSOURCE_BUFFER_ARRAY source must be resolvable to a file descriptor when source_type is AUSOURCE_DESCRIPTOR source must be a file object when source_type is AUSOURCE_FILE_POINTER source must be open file when source_type is AUSOURCE_FILE_POINTER source must be None when source_type is AUSOURCE_FEED object has no parser associated with it aup_normalize_subject_secondary aup_normalize_subject_first_attribute aup_normalize_subject_next_attribute aup_normalize_object_secondary aup_normalize_object_first_attribute aup_normalize_object_next_attribute @ p;L H h H x X ( H ( XH h h 8H h h 8 8 0 P hp 8 X8 X Hx x h ( XH h X H 8 ( 8H h 8 h h
0
XX
X
( @ ` ( 8 x ( zR x $ 8 FJ w ?;*3$" D Az
M d ! GY $ | b Dk
I _
I A # AY D BBE D(D0DP
0A(A BBBF $ AQ0|
AA $ 4 0k AQ R
AA $ \ x AQ0
AC 4 p AMD0G
AAE O
AAG 4 AU
J S 3 AU
J R 4 AU
J S (
4 h Da
K Y
G T ph Da
K Y
G t h Da
K Y
G h Da
K Y
G `h Da
K Y
G $ ] Ag
H R
F J D[
Q Y h Da
K Y
G < hh Da
K Y
G $ \ AQ `
AE ` Da
K Z
F a Da
K Y
G e D_
M U
K pW Da
K O
A W Da
K O
A $ W Da
K O
A D 0e D_
M \
D d h Da
K Y
G e D_
M \
D $ AQ T
AI s Db
J Q
G s Db
J Q
G xe D_
M \
D , , AJ
E W
I V
J R \ Hs Db
J Q
G | h Da
K Y
G s Db
J Q
G Xh Da
K Y
G s Db
J Q
G s Db
J Q
G hs Db
J Q
G < s Db
J Q
G \ (h Da
K Y
G | xh Da
K Y
G s Db
J Q
G (s Db
J Q
G s Db
J Q
G s Db
J Q
G Hs Db
J Q
G < h Da
K Y
G $ \ AQ T
AI s Db
J Q
G s Db
J Q
G P? D]
G $ p AQ S
AJ $ AQ Q
AD $ 4 p AJP
AF $ \ AQ0n
AG $ AQ@r
AK $ X AQ@r
AK _ Da
K @? D]
G `W Da
K O
A 4 _ Da
K $ T AQ0^
AG $ | h@ A^
A L
D O 4 y BAA D
AABD $ : A/
H A < P< p D T b q 5
|k X ` o (
0
- o o o o x 6 6 &6 66 F6 V6 f6 v6 6 6 6 6 6 6 6 6 7 7 &7 67 F7 V7 f7 v7 7 7 7 7 7 7 7 7 8 8 &8 68 F8 V8 f8 v8 8 8 8 8 8 8 8 8 9 9 &9 69 F9 V9 f9 v9 9 9 9 9 9 9 9 9 : : &: 6: F: V: f: v: : : : : : : : : ; ; &; 6; F; V; f; v; ; ; ; ; ; Parsing library for audit messages.
The module defines the following exceptions:
NoParser: Raised if the underlying C code parser is not bound to the AuParser object.
AuParser(source_type, source)
Construct a new audit parser object and bind it to input data.
source_type: one of the AUSOURCE_* constants.
source: the input data, dependent on the source_type as follows:
AUSOURCE_LOGS: None (system log files will be parsed)
AUSOURCE_FILE: string containing file path name
AUSOURCE_FILE_ARRAY: list or tuple of strings each containing a file path name
AUSOURCE_BUFFER: string containing audit data to parse
AUSOURCE_BUFFER_ARRAY: list or tuple of strings each containing audit data to parse
AUSOURCE_DESCRIPTOR: integer file descriptor (e.g. fileno)
AUSOURCE_FILE_POINTER: file object (e.g. types.FileType)
AUSOURCE_FEED: None (data supplied via feed()
interpret_sock_address() Return an interpretation of the current field's socket address. Only supported on sockaddr field types.
If the field cannot be interpreted the field is returned unmodified.
Raises exception (RuntimeError) on error
interpret_sock_address() Return an interpretation of the current field's socket port. Only supported on sockaddr field types.
If the field cannot be interpreted the field is returned unmodified.
Raises exception (RuntimeError) on error
interpret_sock_family() Return an interpretation of the current field's socket family. Only supported on sockaddr field types.
If the field cannot be interpreted the field is returned unmodified.
Raises exception (RuntimeError) on error
interpret_realpath() Return an interpretation of the current field as a realpath string that has the chosen character escaping applied.
If the field cannot be interpreted the field is returned unmodified.
Raises exception (RuntimeError) on error
interpret_field() Return an interpretation of the current field as a string that has the chosen character escaping applied.
If the field cannot be interpreted the field is returned unmodified.
Raises exception (RuntimeError) on error
get_field_int() Get current field’s value as an integer.
get_field_int() allows access to the value as an int of the current
field of the current record in the current event.
Returns field's numeric value.
Raises exception (EnvironmentError) on error
get_field_type() Get current field’s data type value.
get_field_type() returns a value from the auparse_type_t enum that
describes the kind of data in the current field of the current record
in the current event.
Returns AUPARSE_TYPE_UNCLASSIFIED if the field’s data type has no
known description or is an integer. Otherwise it returns another enum.
Fields with the type AUPARSE_TYPE_ESCAPED must be interpreted to access
their value since those field’s raw value is encoded.
get_field_str() get current field’s value
get_field_str() allows access to the value in the current field of the
current record in the current event.
Returns String.
Raises exception (RuntimeError) on error
get_field_name() Get current field’s name.
get_field_name() allows access to the current field name of the
current record in the current event.
Returns None if the field value is unavailable.
Returns String.
Raises exception (RuntimeError) on error
find_field_next() Get next occurrence of field name
find_field_next() returns the value associated next occurrence of field name.
Returns value associated with field or None if there is no next field.
Raises exception (EnvironmentError) on error.
find_field(name) Search for field name.
find_field() will scan all records in an event to find the first
occurrence of the field name passed to it. Searching begins from the
cursor’s current position. The field name is stored for subsequent
searching.
Returns value associated with field or None if not found.
get_record_text() Return unparsed record data
get_record_text() returns the full unparsed record.
Raises exception (EnvironmentError) on error.
get_num_fields() Get the number of fields.
Returns the number of fields in the current event.
Raises exception (EnvironmentError) on error.
next_field() Advance the field cursor.
next_field() moves the library’s internal cursor to point to the next
field in the current record of the current event.
Returns True on success, False if there is no more fields exist
first_field() Reposition field cursor.
Returns True on success, False if there is no event data
auparse_get_filename() get the filename where record was found
get_filename() will return the name of the source file where the
record was found if the source type is AUSOURCE_FILE or
AUSOURCE_FILE_ARRAY. For other source types the return value will be
None.
auparse_get_line_number() get line number where record was found
get_line_number will return the source input line number for
the current record of the current event. Line numbers start at 1. If
the source input type is AUSOURCE_FILE_ARRAY the line numbering will
reset back to 1 each time a new life in the file array is opened.
Raises exception (RuntimeError) on error.
get_type_name() Get current record’s type name.
get_type_name() allows access to the current record type name in the
current event.
Raises exception (LookupError) on error.
get_type() Get record’s type.
get_type() will return the integer value for the current record of the
current event.
Returns record type.
Raises exception (LookupError) on error.
goto_record_num() Move record cursor to specific position.
goto_record_num() will move the internal library cursors to point
to a specific physical record number. Records within the same event are
numbered starting from 0. This is generally not needed but there are
some cases where one may want precise control over the exact record
being looked at.
Returns True on success, False if no more records in current event
Raises exception (EnvironmentError) on error.
next_record() Advance record cursor.
next_record() will move the internal library cursors to point to the
next record of the current event.
Returns True on success, False if no more records in current event
Raises exception (EnvironmentError) on error.
first_record() Reposition record cursor.
first_record() repositions the internal cursors of the parsing library
to point to the first record in the current event.
Return True for success, False if there is no event data.
Raises exception (EnvironmentError) on error.
get_num_records() Get the number of records.
Returns the number of records in the current event.
Raises exception (RuntimeError) on error.
get_timestamp() Return current event's timestamp.
Returns the current event's timestamp info as an AuEvent object.
No Return value, raises exception (EnvironmentError) on error.
aup_normalize_key() This function positions the internal
cursor on the key field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_how() This returns a string that indicates the
how the object is being accessed. This is usually a program.
Raises exception (RuntimeError) on error
aup_normalize_subject_primary() This function positions the internal
cursor on the results field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_object_kind() This returns a string that indicates the
kind of thing the object is.
Raises exception (RuntimeError) on error
aup_normalize_object_next_attribute() This function positions the internal
cursor on the next object's attribute field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_object_first_attribute() This function positions the internal
cursor on the object's first attribute field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_object_secondary() This function positions the internal
cursor on the object's secondary field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_object_primary() This function positions the internal
cursor on the object's field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_get_action() This returns a string that indicates the
subject's action.
Raises exception (RuntimeError) on error
aup_normalize_subject_kind() This returns a string that indicates the
kind of account the subject is.
Raises exception (RuntimeError) on error
aup_normalize_subject_next_attribute() This function positions the internal
cursor on the next subject's attribute field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_subject_first_attribute() This function positions the internal
cursor on the subject's first attribute field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_subject_secondary() This function positions the internal
cursor on the subject's secondary field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_subject_primary() This function positions the internal
cursor on the subject's field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_session() This function positions the internal cursor on
the session's field of the event.
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
aup_normalize_get_event_kind() This returns a string that indicates what
kind of event this is.
Raises exception (RuntimeError) on error
aup_normalize(opt) Normalize the audit event for uniform access to fields.
aup_normalize() takes an argument to decide if it should also gather subject
and object attributes. The possible values are:
NORM_OPT_ALL:
This means include subject and object attributes
NORM_OPT_NO_ATTRS:
This means do not gather subject and object attributes
Returns True on success
Returns False if uninitialized
Raises exception (ValueError) on error
parse_next_event() Advance the parser to the next event.
parse_next_event() will position the cursors at the first field of the first
record of the next event in a file or buffer. It does not skip events
or honor any search criteria that may be stored.
Returns True if parser advances to next event.
Returns False if there are no more events to parse
Raises exception (EnvironmentError) on error
search_next_event() Find the next event that meets search criteria.
search_next_event() will scan the input source and evaluate whether
any record in an event contains the data being searched
for. Evaluation is done at the record level.
Returns True if a match was found
Returns False if a match was not found.
Raises exception (EnvironmentError) on error
search_clear() Clear search parameters.
ausearch_clear clears any search parameters stored in the parser
instance and frees memory associated with it.
No Return value.
search_set_stop(where) Set where cursor is positioned on search match.
search_set_stop() determines where the internal cursor will stop when
a search condition is met. The possible values are:
AUSEARCH_STOP_EVENT:
This one repositions the cursors to the first field of the first
record of the event containing the items searched for.
AUSEARCH_STOP_RECORD:
This one repositions the cursors to the first field of the record
containing the items searched for.
AUSEARCH_STOP_FIELD:
This one simply stops on the current field when the evaluation of the
rules becomes true.
No Return value, raises exception (ValueError) on error.
search_add_regex(regexp) Add a regular expression to the search criteria.
No Return value, raises exception (EnvironmentError) on error.
search_add_timestamp_item_ex(op, sec, milli, serial, how) Build up search rule
search_add_timestamp_item_ex adds an event time condition to the current audit
search expression. Its similar to search_add_timestamp_item except it adds
the event serial number.
search_add_timestamp_item(op, sec, milli, how) Build up search rule
search_add_timestamp_item adds an event time condition to the current audit
search expression. The search conditions can then be used to scan logs,
files, or buffers for something of interest. The op parameter specifies the
desired comparison. Legal op values are "<", "<=", ">=", ">" and
"=". The left operand of the comparison operator is the timestamp of the
examined event, the right operand is specified by the sec and milli
parameters.
The how parameter determines how this search expression will affect the
existing search expression, if one is already defined. The possible
values are:
AUSEARCH_RULE_CLEAR:
Clear the current search expression, if any, and use only this search
expression.
AUSEARCH_RULE_OR:
If a search expression E is already configured, replace it by
(E || this_search_expression).
AUSEARCH_RULE_AND:
If a search expression E is already configured, replace it by
(E && this_search_expression).
No Return value, raises exception (EnvironmentError) on error.
search_add_interpreted_item(field, op, value, how) Build up search rule
search_add_interpreted_item() adds one search condition to the current audit
search expression. The search conditions can then be used to scan logs,
files, or buffers for something of interest. The field value is the field
name that the value will be checked for. The op variable describes what
kind of check is to be done. Legal op values are:
'exists':
Just check that a field name exists
'=':
locate the field name and check that the value associated with it
is equal to the value given in this rule.
'!=':
locate the field name and check that the value associated with
it is NOT equal to the value given in this rule.
The value parameter is compared to the interpreted field value (the value
that would be returned by AuParser.interpret_field).
The how parameter determines how this search expression will affect the
existing search expression, if one is already defined. The possible
values are:
AUSEARCH_RULE_CLEAR:
Clear the current search expression, if any, and use only this search
expression.
AUSEARCH_RULE_OR:
If a search expression E is already configured, replace it by
(E || this_search_expression).
AUSEARCH_RULE_AND:
If a search expression E is already configured, replace it by
(E && this_search_expression).
No Return value, raises exception (EnvironmentError) on error.
search_add_item(field, op, value, how) Build up search rule
search_add_item() adds one search condition to the current audit search
expression. The search conditions can then be used to scan logs, files, or
buffers for something of interest. The field value is the field name
that the value will be checked for. The op variable describes what
kind of check is to be done. Legal op values are:
'exists':
Just check that a field name exists
'=':
locate the field name and check that the value associated with it
is equal to the value given in this rule.
'!=':
locate the field name and check that the value associated with
it is NOT equal to the value given in this rule.
The value parameter is compared to the uninterpreted field value.
The how parameter determines how this search expression will affect the
existing search expression, if one is already defined. The possible
values are:
AUSEARCH_RULE_CLEAR:
Clear the current search expression, if any, and use only this search
expression.
AUSEARCH_RULE_OR:
If a search expression E is already configured, replace it by
(E || this_search_expression).
AUSEARCH_RULE_AND:
If a search expression E is already configured, replace it by
(E && this_search_expression).
No Return value, raises exception (EnvironmentError) on error.
search_add_expression(expression, how) Build up search expression
ausearch_add_item adds an expression to the current audit search
expression. The search conditions can then be used to scan logs,
files, or buffers for something of interest. The expression parameter
contains an expression, as specified in ausearch-expression(5).
The how parameter determines how this search expression will affect the
existing search expression, if one is already defined. The possible
values are:
AUSEARCH_RULE_CLEAR:
Clear the current search expression, if any, and use only this search
expression.
AUSEARCH_RULE_OR:
If a search expression E is already configured, replace it by
(E || this_search_expression).
AUSEARCH_RULE_AND:
If a search expression E is already configured, replace it by
(E && this_search_expression).
No Return value, raises exception (EnvironmentError) on error.
reset() Reset audit parser instance
reset resets all internal cursors to the beginning.
It closes files and descriptors.
Returns None.
Raises exception (EnvironmentError) on error
set_escape_mode(mode) Set audit parser escaping
This function sets the character escaping applied to value fields in the audit record.
Returns None.
add_callback(callback, user_data) add a callback handler for notifications.
auparse_add_callback adds a callback function to the parse state which
is invoked to notify the application of parsing events.
The signature of the callback is:
callback(au, cb_event_type,user_data)
When the callback is invoked it is passed:
au: the AuParser object
cb_event_type: enumerated value indicating the reason why the callback was invoked
user_data: user supplied private data
The cb_event_type argument indicates why the callback was invoked.
It's possible values are:
AUPARSE_CB_EVENT_READY
A complete event has been parsed and is ready to be examined.
This is logically equivalent to the parse state immediately following
auparse_next_event()
Returns None.
Raises exception (EnvironmentError) on error
feed_age_events() age events by the clock
feed_age_events() should be called to timeout events by the clock.
Any newly complete events will be sent to the callback function.
Returns None.
feed_has_data() determines if there are any records that
are accumulating but not yet ready to emit.
Returns True if data left and false otherwise.
flush_feed() flush any unconsumed feed data through parser
flush_feed() should be called to signal the end of feed input data
and flush any pending parse data through the parsing system.
Returns None.
Raises exception (EnvironmentError) on error
feed(data) supplies new data for the parser to consume.
AuParser() must have been called with a source type of AUSOURCE_FEED.
The parser consumes as much data as it can invoking a user supplied
callback specified with add_callback() with a cb_event_type of
AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event
in the data stream. Data not fully parsed will persist and be prepended
to the next feed data. After all data has been feed to the parser flush_feed()
should be called to signal the end of input data and flush any pending
parse data through the parsing system.
Returns None.
Raises exception (EnvironmentError) on error
An internal object which encapsulates the timestamp, serial number
and host information of an audit event. The object cannot be
instantiated from python code, rather it is returned from the
audit parsing API. _r kr rr 0> ` `> = l b @ r pb @ r b r a k pE r E r pa ` r 0D r ` r _ ` s _ s @^ ;s ] ` Ls \ \s \ is 0\ {s [ s Z @ s Z s Z s Y Hy Y hy X y X s W ` t W t V y V y U z U cK| Wq"1ћ085d 1, \sZ}D,7zw:NU+d". &eYtǻɓ>OY?vCo @NnEsSb1fh'#\,bwٔPmxMѝf` oLrHhafѿ2J~II= ɷ.>KOfP)S Z ,׀l SoiP^dcSyt~J}SĪH$ގH} d4X,|*=U]5OwqB2_cۢZg0G!2ҐC
UV5;D֨ INAzD3s swd_gR0o1Ȋ߅ƋR(;Ϭӟe
ͯ2 f*_,k;&&{srxh l`XXehK۫UZ -K`m/J\*}fp> &_7X =ˋ늶K74{snY7s Bܤ<7U^<7fH.4^-2Z\j%$ 7B&5;NJbV7ϘɁ o壑ʝ{ E9w?T"G /T>w/8u`܄(F絺{2FB jKt0u%[yL+䙿2 Z嬪H[IXDXq<5l6==@h1~O6rhNDg.ǂ/
\[̣;,V FR <sSY5!'=*(:>BB#-4NئsWOt_T:M6Vnǒa uFFdYȳboT*Ѓ?W\-a`RFNfX`5Io(^R!f
7Vh>-xRUh2SkڽȠTB 5R5U K6WsA}OO :u U ~* ?$wϳ8 f '@%hŲ!^%?OV߃w{(ߟ )I[M8t - rp#(id=-6iE%j-BT0h%' EzgN_udۘ&H="īDh]g䱌=eWh3ltsخX3n '2o !Yf