search

magneticstain / Inquisition

An advanced and versatile open-source network anomaly detection platform
MIT License
8 stars 4 forks source link

Strip Formatting Characters From Raw Log Before Including in App Log #137

Closed magneticstain closed 5 years ago

magneticstain commented 5 years ago

During Investigation of Issue #135 , it was found that line breaks in the logs can be reflected in the application log files as well. These, and any other formatting characters like that, should be stripped out before writing it to the log.

magneticstain commented 5 years ago

Fixed:

2018-11-18 20:37:16,364 [ DEBUG ] [ lib.anatomize.Parser ] processing log [[[ Nov 18 20:37:14 lhr1inquisition01 sudo: pam_unix(sudo:session): session closed for user root ]]] using [ PARSER ID: 2 // NAME: parser_auth_log // READING FROM LOG FILE: /var/log/auth.log // OFFSET FILE: /opt/inquisition/tmp/2_parser_auth_log.offset // TOTAL LOGS PROCESSED: { 5 } ]
2018-11-18 20:37:16,364 [ DEBUG ] [ lib.anatomize.Parser ] POST-PROCESSED LOG [[[ Nov 18 20:37:14 lhr1inquisition01 sudo: pam_unix(sudo:session): session closed for user root ]]] using [ PARSER ID: 2 // NAME: parser_auth_log // READING FROM LOG FILE: /var/log/auth.log // OFFSET FILE: /opt/inquisition/tmp/2_parser_auth_log.offset // TOTAL LOGS PROCESSED: { 5 } ]