search

jasonish / py-idstools

idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)
Other
276 stars 85 forks source link

appStats u2 can't work #68

Open AAyyy opened 6 years ago

AAyyy commented 6 years ago

when i use idstoos to convert a appStats file it report like this:WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null

u2openappid it dump like:tatTime="1527172305",appName="HTTP",txBytes="1105",rxBytes="4238" statTime="1527172305",appName="uri_html",txBytes="1105",rxBytes="4238" statTime="1527172305",appName="HTTP",txBytes="1785",rxBytes="8359" statTime="1527172305",appName="uri_html",txBytes="1785",rxBytes="8359" statTime="1527172305",appName="HTTP",txBytes="24515",rxBytes="110793" statTime="1527172305",appName="__unknown",txBytes="245",rxBytes="2234" statTime="1527172305",appName="uri_html",txBytes="24515",rxBytes="110793" statTime="1527172320",appName="HTTP",txBytes="11870",rxBytes="52383" statTime="1527172320",appName="uri_html",txBytes="11870",rxBytes="52383" statTime="1527172335",appName="HTTP",txBytes="23700",rxBytes="91460"

idstoots can't support this? thx!!!

jasonish commented 6 years ago

Is app stats a unified2 formatted file? Can you provide me with a sample?

On Wed, May 30, 2018 at 17:08 AAyyy notifications@github.com wrote:

when i use idstoos to convert a appStats file it report like this:WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca590> null WARNING: Unknown record type: <class 'idstools.unified2.Unknown'>: <idstools.unified2.Unknown object at 0x34ca5d0> null u2openappid it dump like:tatTime="1527172305",appName="HTTP",txBytes="1105",rxBytes="4238" statTime="1527172305",appName="uri_html",txBytes="1105",rxBytes="4238" statTime="1527172305",appName="HTTP",txBytes="1785",rxBytes="8359" statTime="1527172305",appName="uri_html",txBytes="1785",rxBytes="8359" statTime="1527172305",appName="HTTP",txBytes="24515",rxBytes="110793" statTime="1527172305",appName="__unknown",txBytes="245",rxBytes="2234" statTime="1527172305",appName="uri_html",txBytes="24515",rxBytes="110793" statTime="1527172320",appName="HTTP",txBytes="11870",rxBytes="52383" statTime="1527172320",appName="uri_html",txBytes="11870",rxBytes="52383" statTime="1527172335",appName="HTTP",txBytes="23700",rxBytes="91460"

idstoots can't support this? thx!!!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/jasonish/py-idstools/issues/68, or mute the thread https://github.com/notifications/unsubscribe-auth/AAnUEwclcj_lGbmj8zlvq18oD73HUYgcks5t3yZdgaJpZM4UUJXm .