puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
64 stars 7 forks source link

Journal format parsing support #37

Closed puffyCid closed 1 year ago

puffyCid commented 1 year ago

This PR adds support for parsing the Systemd Journal files. Its a prerequisite before we can parse sudo logs #35 .

codecov[bot] commented 1 year ago

Codecov Report

Patch coverage: 87.21% and project coverage change: +0.11 :tada:

Comparison is base (42a23c2) 84.23% compared to head (91748dd) 84.35%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #37 +/- ## ========================================== + Coverage 84.23% 84.35% +0.11% ========================================== Files 292 301 +9 Lines 35638 37011 +1373 ========================================== + Hits 30020 31220 +1200 - Misses 5618 5791 +173 ``` | [Impacted Files](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) | Coverage Δ | | |---|---|---| | [artemis-core/src/artifacts/os/linux/error.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvZXJyb3IucnM=) | `8.33% <0.00%> (-0.76%)` | :arrow_down: | | [...s-core/src/artifacts/os/linux/executable/parser.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvZXhlY3V0YWJsZS9wYXJzZXIucnM=) | `80.95% <ø> (ø)` | | | [artemis-core/src/utils/error.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy91dGlscy9lcnJvci5ycw==) | `4.54% <0.00%> (-0.72%)` | :arrow_down: | | [artemis-core/src/utils/nom\_helper.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy91dGlscy9ub21faGVscGVyLnJz) | `97.32% <ø> (+0.89%)` | :arrow_up: | | [...emis-core/src/artifacts/os/linux/journals/error.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvam91cm5hbHMvZXJyb3IucnM=) | `9.09% <9.09%> (ø)` | | | [artemis-core/src/artifacts/linux\_collection.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvbGludXhfY29sbGVjdGlvbi5ycw==) | `58.01% <57.14%> (-0.05%)` | :arrow_down: | | [...re/src/artifacts/os/linux/journals/objects/data.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvam91cm5hbHMvb2JqZWN0cy9kYXRhLnJz) | `66.66% <66.66%> (ø)` | | | [artemis-core/src/artifacts/os/linux/artifacts.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvYXJ0aWZhY3RzLnJz) | `78.83% <77.77%> (+0.34%)` | :arrow_up: | | [...e/src/artifacts/os/linux/journals/objects/array.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvam91cm5hbHMvb2JqZWN0cy9hcnJheS5ycw==) | `84.12% <84.12%> (ø)` | | | [.../src/artifacts/os/linux/journals/objects/header.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3MvbGludXgvam91cm5hbHMvb2JqZWN0cy9oZWFkZXIucnM=) | `85.82% <85.82%> (ø)` | | | ... and [9 more](https://app.codecov.io/gh/puffyCid/artemis/pull/37?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) | |

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.