search

mushorg / glastopf

Web Application Honeypot
http://glastopf.org
551 stars 172 forks source link

Make TCP logstash work #284

Closed kc0bfv closed 6 years ago

kc0bfv commented 6 years ago

Currently, logstash.LogstashHandler is an alias for UDPLogstashHandler - thus, handler TCP is ignored, and glastopf always uses UDP logstash. This change makes it work properly.

kc0bfv commented 6 years ago

Also - I broke the log message components out into their constituent parts, and used a feature of python-logstash to send them to logstash. That makes ingest into logstash much simpler - it eliminates what would become a complicated grok statement, that probably wouldn't work that well anyway.

glaslos commented 6 years ago

Thanks for taking a look at this. If I'm not mistaken, if you are changing this line to sudo service mongod start the test should pass again.

kc0bfv commented 6 years ago

Not sure exactly what's up at this point - the PHP includes configure finds for BFR seem to be very different from what my build found - I got: checking for PHP includes... -I/usr/include/php/20151012 -I/usr/include/php/20151012/main -I/usr/include/php/20151012/TSRM -I/usr/include/php/20151012/Zend -I/usr/include/php/20151012/ext -I/usr/include/php/20151012/ext/date/lib

This one seems to have found a bunch of junk for PHP 5 maybe.

kc0bfv commented 6 years ago

Also - I need to check out SNARE/TANNER - didn't realize there was a successor to this project until I stumbled on mushmush.org

glaslos commented 6 years ago

Argh, this is related to the changes we did in BFR for PHP7. ignore the issues, I'll merge your PR and I might fix it some other time 👍