Andreas Steffen
903c68e069
The logrotate function causes the apt history to be split into several parts at arbitrary points in time. If history.log only is parsed then some package installation changes stored in zipped backup history files might get lost. Thus sw-collector now searches all backup history files until a date older than the current event stored in the collector.db database is found, so that no entries get overlooked.
25 lines
2.1 KiB
Plaintext
25 lines
2.1 KiB
Plaintext
dave:: cat /var/log/auth.log::sending TLS CertificateVerify handshake::YES
|
|
dave:: cat /var/log/auth.log::collected ... SW records::YES
|
|
dave:: cat /var/log/auth.log::strongswan.org__strongSwan.*swidtag::YES
|
|
carol::cat /var/log/auth.log::received SASL Success result::YES
|
|
carol::cat /var/log/auth.log::collected ... SW ID events::YES
|
|
carol::cat /var/log/auth.log::collected 3 SW records::YES
|
|
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_DAVE::YES
|
|
alice::cat /var/log/daemon.log::checking certificate status of.*C=CH, O=strongSwan Project, OU=Accounting, CN=dave@strongswan.org::YES
|
|
alice::cat /var/log/daemon.log::certificate status is good::YES
|
|
alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by TLS certificate::YES
|
|
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=strongSwan Project, OU=Accounting, CN=dave@strongswan.org.*authenticated by certificate::YES
|
|
alice::cat /var/log/daemon.log::received software inventory with ... items for request 3 at last eid 1 of epoch::YES
|
|
alice::cat /var/log/daemon.log::role=.softwareCreator licensor tagCreator::YES
|
|
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
|
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
|
|
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
|
|
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
|
|
alice::cat /var/log/daemon.log::SASL client identity is.*carol::YES
|
|
alice::cat /var/log/daemon.log::user AR identity.*carol.*authenticated by password::YES
|
|
alice::cat /var/log/daemon.log::received software ID events with ... items for request 9 at last eid 3 of epoch::YES
|
|
alice::cat /var/log/daemon.log::3 SWID tag target::YES
|
|
alice::cat /var/log/daemon.log::received software inventory with 3 items for request 9 at last eid 3 of epoch::YES
|
|
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
|
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
|