mandiant / macos-UnifiedLogs

Apache License 2.0
211 stars 17 forks source link

Failed to parse log message for `DNS Resource Record Type: 255` #6

Closed fukusuket closed 1 year ago

fukusuket commented 1 year ago

Sorry, I created pull request #4 first, but I'll also create an issue for management purposes.

Describe the issue Failed to parse log message for DNS Resource Record Type: 255 as follows.

Step to Reproduce

  1. git clone https://github.com/mandiant/macos-UnifiedLogs.git (c857f6fcde71afc150a7bf73c47d122ebcb29b46)
  2. cd examples/unifiedlog_parser
  3. cargo build --release
  4. ../target/release/unifiedlog_parser -l true -o out.csv

Expected behavior No warnings.

Actual behavior The following warning is printed

08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
08:16:19 [WARN] [macos-unifiedlogs] Unknown DNS Resource Record Type: 255
...

Environment

Additional context When I checked with the builtin log command, I was able to confirm the following log message. (255 converted to ANY)

fukusuke@fukusukenoAir ~ % log show --predicate 'formatString CONTAINS "rrtype" AND eventMessage CONTAINS "DNSService" AND eventMessage CONTAINS "ANY)"'
...
2023-05-25 21:33:24.997500+0900 0xe17      Default     0x0                  445    0    mDNSResponder: [com.apple.mDNSResponder:Default] [R28504->Q4319] DNSServiceQueryRecord(<mask.hash: '7hptNQxpvylxuMlaJdtJHQ=='>, ANY) RESULT ADD interface 0: (mortal, DNSSEC Indeterminate)<mask.hash: 'O8S3gVjOaBTaUgN+EINRTA=='>

--style json

{
  "traceID": 4833775271936004,
  "eventMessage": "[R28172->Q34170] DNSServiceQueryRecord(<mask.hash: 'M4ZcA2oSbjoDev4Cykrh3w=='>, ANY) RESULT ADD interface 0: (mortal, DNSSEC Indeterminate)<mask.hash: 'qNWLOxxZAdUcdDpEKiwVeA=='>",
  "eventType": "logEvent",
  "source": null,
  "formatString": "[R%u->Q%u] DNSService%{public}s(%{sensitive, mask.hash, mdnsresponder:domain_name}.*P, %{mdns:rrtype}d) RESULT %{mdns:addrmv_upper}d interface %d: (%{mdns:mortality}d, %{public, mdns:dnssec_result}d)%{sensitive, mask.hash}s",
  "activityIdentifier": 0,
  "subsystem": "com.apple.mDNSResponder",
  "category": "Default",
  "threadID": 3607,
  "senderImageUUID": "00AA92CE-B5C8-3C17-82B3-C618AB43D536",
  "backtrace": {
    "frames": [
      {
        "imageOffset": 676888,
        "imageUUID": "00AA92CE-B5C8-3C17-82B3-C618AB43D536"
      }
    ]
  },
  "bootUUID": "6B669862-9D8A-4B5A-84C1-14B938C396DF",
  "processImagePath": "/usr/sbin/mDNSResponder",
  "timestamp": "2023-05-25 20:56:49.834349+0900",
  "senderImagePath": "/usr/sbin/mDNSResponder",
  "machTimestamp": 22699654551097,
  "messageType": "Default",
  "processImageUUID": "00AA92CE-B5C8-3C17-82B3-C618AB43D536",
  "processID": 445,
  "senderProgramCounter": 676888,
  "parentActivityIdentifier": 0,
  "timezoneName": ""
}