From 767f35178fc9a10c60ecde676db806f0902aca03 Mon Sep 17 00:00:00 2001 From: JSCU-CNI <121175071+JSCU-CNI@users.noreply.github.com> Date: Wed, 25 Sep 2024 16:40:41 +0200 Subject: [PATCH 1/2] make cloud-init log line regex more strict --- dissect/target/plugins/os/unix/log/messages.py | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/dissect/target/plugins/os/unix/log/messages.py b/dissect/target/plugins/os/unix/log/messages.py index d739145dd..08a70567a 100644 --- a/dissect/target/plugins/os/unix/log/messages.py +++ b/dissect/target/plugins/os/unix/log/messages.py @@ -6,7 +6,7 @@ from dissect.target.exceptions import UnsupportedPluginError from dissect.target.helpers.record import TargetRecordDescriptor from dissect.target.helpers.utils import year_rollover_helper -from dissect.target.plugin import Plugin, export +from dissect.target.plugin import Plugin, alias, export MessagesRecord = TargetRecordDescriptor( "linux/log/messages", @@ -24,7 +24,7 @@ RE_DAEMON = re.compile(r"^[^:]+:\d+:\d+[^\[\]:]+\s([^\[:]+)[\[|:]{1}") RE_PID = re.compile(r"\w\[(\d+)\]") RE_MSG = re.compile(r"[^:]+:\d+:\d+[^:]+:\s(.*)$") -RE_CLOUD_INIT_LINE = re.compile(r"(?P.*) - (?P.*)\[(?P\w+)\]\: (?P.*)$") +RE_CLOUD_INIT_LINE = re.compile(r"^(?P\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}) - (?P.*)\[(?P\w+)\]\: (?P.*)$") # noqa: E501 class MessagesPlugin(Plugin): @@ -43,19 +43,12 @@ def check_compatible(self) -> None: if not self.log_files: raise UnsupportedPluginError("No log files found") - @export(record=MessagesRecord) - def syslog(self) -> Iterator[MessagesRecord]: - """Return contents of /var/log/messages*, /var/log/syslog* and cloud-init logs. - - See ``messages`` for more information. - """ - return self.messages() - + @alias("syslog") @export(record=MessagesRecord) def messages(self) -> Iterator[MessagesRecord]: """Return contents of /var/log/messages*, /var/log/syslog* and cloud-init logs. - Note: due to year rollover detection, the contents of the files are returned in reverse. + Due to year rollover detection, the contents of the files are returned in reverse. The messages log file holds information about a variety of events such as the system error messages, system startups and shutdowns, change in the network configuration, etc. Aims to store valuable, non-debug and From 31686a3c2beef4ac52ebd2b712f4a5eab162beab Mon Sep 17 00:00:00 2001 From: Computer Network Investigation <121175071+JSCU-CNI@users.noreply.github.com> Date: Mon, 30 Sep 2024 08:40:54 +0200 Subject: [PATCH 2/2] Update dissect/target/plugins/os/unix/log/messages.py Co-authored-by: Stefan de Reuver <9864602+Horofic@users.noreply.github.com> --- dissect/target/plugins/os/unix/log/messages.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dissect/target/plugins/os/unix/log/messages.py b/dissect/target/plugins/os/unix/log/messages.py index 08a70567a..8a32ff83c 100644 --- a/dissect/target/plugins/os/unix/log/messages.py +++ b/dissect/target/plugins/os/unix/log/messages.py @@ -24,7 +24,9 @@ RE_DAEMON = re.compile(r"^[^:]+:\d+:\d+[^\[\]:]+\s([^\[:]+)[\[|:]{1}") RE_PID = re.compile(r"\w\[(\d+)\]") RE_MSG = re.compile(r"[^:]+:\d+:\d+[^:]+:\s(.*)$") -RE_CLOUD_INIT_LINE = re.compile(r"^(?P\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}) - (?P.*)\[(?P\w+)\]\: (?P.*)$") # noqa: E501 +RE_CLOUD_INIT_LINE = re.compile( + r"^(?P\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}) - (?P.*)\[(?P\w+)\]\: (?P.*)$" +) class MessagesPlugin(Plugin):