| Name | zlogging JSON |
| Version |
0.1.3.post2
JSON |
| download |
| home_page | |
| Summary | zlogging: Bro/Zeek logging framework for Python. |
| upload_time | 2024-03-16 10:15:12 |
| maintainer | Jarry Shaw |
| docs_url | None |
| author | |
| requires_python | <4,>=3.6 |
| license | BSD 3-Clause License |
| keywords |
bro
zeek
logging
|
| VCS |
 |
| bugtrack_url |
|
| requirements |
No requirements were recorded.
|
| Travis-CI |
No Travis.
|
| coveralls test coverage |
No coveralls.
|
================================================
ZLogging - Bro/Zeek logging framework for Python
================================================
Online documentation is available at https://zlogging.readthedocs.io/
The ``ZLogging`` module provides an easy-to-use bridge between the logging
framework of the well-known Bro/Zeek Network Security Monitor (IDS).
As of version 3.0, the ``Bro`` project has been officially renamed to
``Zeek``. [1]_
It was originally developed and derived from the |BroAPT|_ project, which is an
APT detection framework based on the Bro/Zeek IDS and extended with highly
customised and customisable Python wrappers.
.. _BroAPT: https://github.com/JarryShaw/BroAPT
.. |BroAPT| replace:: ``BroAPT``
------------
Installation
------------
.. note::
``ZLogging`` supports Python all versions above and includes **3.6**
.. code:: python
pip install zlogging
-----
Usage
-----
Currently ``ZLogging`` supports the two builtin formats as supported by the
Bro/Zeek logging framework, i.e. ASCII and JSON.
A typical ASCII log file would be like::
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path http
#open 2020-02-09-18-54-09
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
1581245648.761106 CSksID3S6ZxplpvmXg 192.168.2.108 56475 151.139.128.14 80 1 GET ocsp.sectigo.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEML0g5PE3oabJGPJOXafjJNRzPIBBSNjF7EVK2K4Xfpm/mbBeG4AY1h4QIQfdsAWJ+CXcbhDVFyNWosjQ== - 1.1 com.apple.trustd/2.0 - 0 471 200 OK - - (empty) - - - - - - FPtlyEAhcf8orBPu7 - application/ocsp-response
1581245651.379048 CuvUnl4HyhQbCs4tXe 192.168.2.108 56483 23.59.247.10 80 1 GET isrg.trustid.ocsp.identrust.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA== - 1.1 com.apple.trustd/2.0 - 0 1398 200 OK - - (empty) - - - - - - FRfFoq3hSZkdCNDf9l - application/ocsp-response
1581245654.396334 CWo4pd1z97XLB2o0h2 192.168.2.108 56486 23.59.247.122 80 1 GET isrg.trustid.ocsp.identrust.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA== - 1.1 com.apple.trustd/2.0 - 0 1398 200 OK - - (empty) - - - - - - FvQehf1pRsGmwDUzJe - application/ocsp-response
1581245692.728840 CxFQzh2ePtsnQhFNX3 192.168.2.108 56527 23.59.247.10 80 1 GET isrg.trustid.ocsp.identrust.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA== - 1.1 com.apple.trustd/2.0 - 0 1398 200 OK - - (empty) - - - - - - FIeFj8WWNyhA1psGg - application/ocsp-response
1581245701.693971 CPZSNk1Y6kDvAN0KZ8 192.168.2.108 56534 23.59.247.122 80 1 GET isrg.trustid.ocsp.identrust.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA== - 1.1 com.apple.trustd/2.0 - 0 1398 200 OK - - (empty) - - - - - - F0fGHe4RPuNBhYWNv6 - application/ocsp-response
1581245707.848088 Cnab6CHFOprdppKi5 192.168.2.108 56542 23.59.247.122 80 1 GET isrg.trustid.ocsp.identrust.com /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA== - 1.1 com.apple.trustd/2.0 - 0 1398 200 OK - - (empty) - - - - - - FgDBep1h7EPHC8qQB6 - application/ocsp-response
1581245952.784242 CPNd6t3ofePpdNjErl 192.168.2.108 56821 176.31.225.118 80 1 GET tracker.trackerfix.com /announce?info_hash=y\x82es"\x1dV\xde|m\xbe"\xe5\xef\xbe\x04\xb3\x1fW\xfc&peer_id=-qB4210-0ZOn5Ifyl*WF&port=63108&uploaded=0&downloaded=0&left=3225455594&corrupt=0&key=6B23B036&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0 - 1.1 - - 0 0 307 Temporary Redirect - - (empty) - - - - - - - - -
1581245960.123295 CfAkwf2CFI13b24gqf 192.168.2.108 56889 176.31.225.118 80 1 GET tracker.trackerfix.com /announce?info_hash=!u7\xdad\x94x\xecS\x80\x89\x04\x9c\x13#\x84M\x1b\xcd\x1a&peer_id=-qB4210-i36iloGe*QT9&port=63108&uploaded=0&downloaded=0&left=1637966572&corrupt=0&key=ECE6637E&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0 - 1.1 - - 0 0 307 Temporary Redirect - - (empty) - - - - - - - - -
#close 2020-02-09-19-01-40
Its corresponding JSON log file would be like::
{"ts": 1581245648.761106, "uid": "CSksID3S6ZxplpvmXg", "id.orig_h": "192.168.2.108", "id.orig_p": 56475, "id.resp_h": "151.139.128.14", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "ocsp.sectigo.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEML0g5PE3oabJGPJOXafjJNRzPIBBSNjF7EVK2K4Xfpm/mbBeG4AY1h4QIQfdsAWJ+CXcbhDVFyNWosjQ==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["FPtlyEAhcf8orBPu7"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245651.379048, "uid": "CuvUnl4HyhQbCs4tXe", "id.orig_h": "192.168.2.108", "id.orig_p": 56483, "id.resp_h": "23.59.247.10", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "isrg.trustid.ocsp.identrust.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 1398, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["FRfFoq3hSZkdCNDf9l"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245654.396334, "uid": "CWo4pd1z97XLB2o0h2", "id.orig_h": "192.168.2.108", "id.orig_p": 56486, "id.resp_h": "23.59.247.122", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "isrg.trustid.ocsp.identrust.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 1398, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["FvQehf1pRsGmwDUzJe"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245692.72884, "uid": "CxFQzh2ePtsnQhFNX3", "id.orig_h": "192.168.2.108", "id.orig_p": 56527, "id.resp_h": "23.59.247.10", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "isrg.trustid.ocsp.identrust.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 1398, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["FIeFj8WWNyhA1psGg"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245701.693971, "uid": "CPZSNk1Y6kDvAN0KZ8", "id.orig_h": "192.168.2.108", "id.orig_p": 56534, "id.resp_h": "23.59.247.122", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "isrg.trustid.ocsp.identrust.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 1398, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["F0fGHe4RPuNBhYWNv6"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245707.848088, "uid": "Cnab6CHFOprdppKi5", "id.orig_h": "192.168.2.108", "id.orig_p": 56542, "id.resp_h": "23.59.247.122", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "isrg.trustid.ocsp.identrust.com", "uri": "/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==", "referrer": "-", "version": "1.1", "user_agent": "com.apple.trustd/2.0", "origin": "-", "request_body_len": 0, "response_body_len": 1398, "status_code": 200, "status_msg": "OK", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": ["FgDBep1h7EPHC8qQB6"], "resp_filenames": null, "resp_mime_types": ["application/ocsp-response"]}
{"ts": 1581245952.784242, "uid": "CPNd6t3ofePpdNjErl", "id.orig_h": "192.168.2.108", "id.orig_p": 56821, "id.resp_h": "176.31.225.118", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "tracker.trackerfix.com", "uri": "/announce?info_hash=y\\x82es\"\\x1dV\\xde|m\\xbe\"\\xe5\\xef\\xbe\\x04\\xb3\\x1fW\\xfc&peer_id=-qB4210-0ZOn5Ifyl*WF&port=63108&uploaded=0&downloaded=0&left=3225455594&corrupt=0&key=6B23B036&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0", "referrer": "-", "version": "1.1", "user_agent": "-", "origin": "-", "request_body_len": 0, "response_body_len": 0, "status_code": 307, "status_msg": "Temporary Redirect", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": null, "resp_filenames": null, "resp_mime_types": null}
{"ts": 1581245960.123295, "uid": "CfAkwf2CFI13b24gqf", "id.orig_h": "192.168.2.108", "id.orig_p": 56889, "id.resp_h": "176.31.225.118", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "tracker.trackerfix.com", "uri": "/announce?info_hash=!u7\\xdad\\x94x\\xecS\\x80\\x89\\x04\\x9c\\x13#\\x84M\\x1b\\xcd\\x1a&peer_id=-qB4210-i36iloGe*QT9&port=63108&uploaded=0&downloaded=0&left=1637966572&corrupt=0&key=ECE6637E&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0", "referrer": "-", "version": "1.1", "user_agent": "-", "origin": "-", "request_body_len": 0, "response_body_len": 0, "status_code": 307, "status_msg": "Temporary Redirect", "info_code": null, "info_msg": "-", "tags": [], "username": "-", "password": "-", "proxied": null, "orig_fuids": null, "orig_filenames": null, "orig_mime_types": null, "resp_fuids": null, "resp_filenames": null, "resp_mime_types": null}
How to Load/Parse a Log File?
-----------------------------
To load (parse) a log file generically, i.e. when you don't know what format
the log file is, you can simple call the ``~zlogging.loader.parse``,
``zlogging.loader.loads`` functions::
# to parse log at filename
>>> parse('path/to/log')
# to load log from a file object
>>> with open('path/to/log', 'rb') as file:
... load(file)
# to load log from a string
>>> with open('/path/to/log', 'rb') as file:
... loads(file.read())
.. note::
``zlogging.loader.load``, the file object must be opened
in binary mode.
``zlogging.loader.loads``, if the ``data`` suplied is an
encoded string (``str``), the function will first try to decode it as a
bytestring (``bytes``) with ``'ascii'`` encoding.
If you do know the format, you may call the specified functions for each
``zlogging.loader.parse_ascii`` and ``zlogging.loader.parse_json``, etc.
If you would like to customise your own parser, just subclass
``zlogging.loader.BaseParser`` and implement your own ideas.
How to Dump/Write a Log File?
-----------------------------
Before dumping (writing) a log file, you need to create a log **data model**
first. Just like in the Bro/Zeek script language, when customise logging, you
need to notify the logging framework with a new log stream. Here, in
``ZLogging``, we introduced **data model** for the same purpose.
A **data model** is a subclass of ``zlogging.model.Model`` with fields
and data types declared. A typical **data model** can be as following::
class MyLog(Model):
field_one = StringType()
field_two = SetType(element_type=PortType)
where ``field_one`` is ``string`` type, i.e. ``zlogging.types.StringType``;
and ``field_two`` is ``set[port]`` types, i.e. ``zlogging.types.SetType``
of ``zlogging.types.PortType``.
Or you may use type annotations as `PEP 484`_ introduced when declaring **data models**.
All available type hints can be found in ``zlogging.typing``::
class MyLog(Model):
field_one: zeek_string
field_two: zeek_set[zeek_port]
After declaration of your **data model**, you can know dump (write) your log
file with the corresponding functions.
If you would like to customise your own writer, just subclass
``zlogging.loader.BaseWriter`` and implement your own ideas.
.. _PEP 484:
https://www.python.org/dev/peps/pep-0484/
.. [1] https://blog.zeek.org/2018/10/renaming-bro-project_11.html
Raw data
{
"_id": null,
"home_page": "",
"name": "zlogging",
"maintainer": "Jarry Shaw",
"docs_url": null,
"requires_python": "<4,>=3.6",
"maintainer_email": "",
"keywords": "bro,zeek,logging",
"author": "",
"author_email": "Jarry Shaw <jarryshaw@icloud.com>",
"download_url": "https://files.pythonhosted.org/packages/9f/a5/991221dcb6673abb06d5ffca8caa4ae9fbd8125625b2550b43dafebfc83e/zlogging-0.1.3.post2.tar.gz",
"platform": null,
"description": "================================================\nZLogging - Bro/Zeek logging framework for Python\n================================================\n\n Online documentation is available at https://zlogging.readthedocs.io/\n\nThe ``ZLogging`` module provides an easy-to-use bridge between the logging\nframework of the well-known Bro/Zeek Network Security Monitor (IDS).\n\n As of version 3.0, the ``Bro`` project has been officially renamed to\n ``Zeek``. [1]_\n\nIt was originally developed and derived from the |BroAPT|_ project, which is an\nAPT detection framework based on the Bro/Zeek IDS and extended with highly\ncustomised and customisable Python wrappers.\n\n.. _BroAPT: https://github.com/JarryShaw/BroAPT\n.. |BroAPT| replace:: ``BroAPT``\n\n------------\nInstallation\n------------\n\n.. note::\n\n ``ZLogging`` supports Python all versions above and includes **3.6**\n\n.. code:: python\n\n pip install zlogging\n\n-----\nUsage\n-----\n\nCurrently ``ZLogging`` supports the two builtin formats as supported by the\nBro/Zeek logging framework, i.e. ASCII and JSON.\n\nA typical ASCII log file would be like::\n\n #separator \\x09\n #set_separator\t,\n #empty_field\t(empty)\n #unset_field\t-\n #path\thttp\n #open\t2020-02-09-18-54-09\n #fields\tts\tuid\tid.orig_h\tid.orig_p\tid.resp_h\tid.resp_p\ttrans_depth\tmethod\thost\turi\treferrer\tversion\tuser_agent\torigin\trequest_body_len\tresponse_body_len\tstatus_code\tstatus_msg\tinfo_code\tinfo_msg\ttags\tusername\tpassword\tproxied\torig_fuids\torig_filenames\torig_mime_types\tresp_fuids\tresp_filenames\tresp_mime_types\n #types\ttime\tstring\taddr\tport\taddr\tport\tcount\tstring\tstring\tstring\tstring\tstring\tstring\tstring\tcount\tcount\tcount\tstring\tcount\tstring\tset[enum]\tstring\tstring\tset[string]\tvector[string]\tvector[string]\tvector[string]\tvector[string]\tvector[string]\tvector[string]\n 1581245648.761106\tCSksID3S6ZxplpvmXg\t192.168.2.108\t56475\t151.139.128.14\t80\t1\tGET\tocsp.sectigo.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEML0g5PE3oabJGPJOXafjJNRzPIBBSNjF7EVK2K4Xfpm/mbBeG4AY1h4QIQfdsAWJ+CXcbhDVFyNWosjQ==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t471\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFPtlyEAhcf8orBPu7\t-\tapplication/ocsp-response\n 1581245651.379048\tCuvUnl4HyhQbCs4tXe\t192.168.2.108\t56483\t23.59.247.10\t80\t1\tGET\tisrg.trustid.ocsp.identrust.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t1398\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFRfFoq3hSZkdCNDf9l\t-\tapplication/ocsp-response\n 1581245654.396334\tCWo4pd1z97XLB2o0h2\t192.168.2.108\t56486\t23.59.247.122\t80\t1\tGET\tisrg.trustid.ocsp.identrust.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t1398\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFvQehf1pRsGmwDUzJe\t-\tapplication/ocsp-response\n 1581245692.728840\tCxFQzh2ePtsnQhFNX3\t192.168.2.108\t56527\t23.59.247.10\t80\t1\tGET\tisrg.trustid.ocsp.identrust.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t1398\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFIeFj8WWNyhA1psGg\t-\tapplication/ocsp-response\n 1581245701.693971\tCPZSNk1Y6kDvAN0KZ8\t192.168.2.108\t56534\t23.59.247.122\t80\t1\tGET\tisrg.trustid.ocsp.identrust.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t1398\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tF0fGHe4RPuNBhYWNv6\t-\tapplication/ocsp-response\n 1581245707.848088\tCnab6CHFOprdppKi5\t192.168.2.108\t56542\t23.59.247.122\t80\t1\tGET\tisrg.trustid.ocsp.identrust.com\t/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\t-\t1.1\tcom.apple.trustd/2.0\t-\t0\t1398\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFgDBep1h7EPHC8qQB6\t-\tapplication/ocsp-response\n 1581245952.784242\tCPNd6t3ofePpdNjErl\t192.168.2.108\t56821\t176.31.225.118\t80\t1\tGET\ttracker.trackerfix.com\t/announce?info_hash=y\\x82es\"\\x1dV\\xde|m\\xbe\"\\xe5\\xef\\xbe\\x04\\xb3\\x1fW\\xfc&peer_id=-qB4210-0ZOn5Ifyl*WF&port=63108&uploaded=0&downloaded=0&left=3225455594&corrupt=0&key=6B23B036&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0\t-\t1.1\t-\t-\t0\t0\t307\tTemporary Redirect\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\t-\t-\t-\n 1581245960.123295\tCfAkwf2CFI13b24gqf\t192.168.2.108\t56889\t176.31.225.118\t80\t1\tGET\ttracker.trackerfix.com\t/announce?info_hash=!u7\\xdad\\x94x\\xecS\\x80\\x89\\x04\\x9c\\x13#\\x84M\\x1b\\xcd\\x1a&peer_id=-qB4210-i36iloGe*QT9&port=63108&uploaded=0&downloaded=0&left=1637966572&corrupt=0&key=ECE6637E&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0\t-\t1.1\t-\t-\t0\t0\t307\tTemporary Redirect\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\t-\t-\t-\n #close\t2020-02-09-19-01-40\n\nIts corresponding JSON log file would be like::\n\n {\"ts\": 1581245648.761106, \"uid\": \"CSksID3S6ZxplpvmXg\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56475, \"id.resp_h\": \"151.139.128.14\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"ocsp.sectigo.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEML0g5PE3oabJGPJOXafjJNRzPIBBSNjF7EVK2K4Xfpm/mbBeG4AY1h4QIQfdsAWJ+CXcbhDVFyNWosjQ==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 471, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"FPtlyEAhcf8orBPu7\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245651.379048, \"uid\": \"CuvUnl4HyhQbCs4tXe\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56483, \"id.resp_h\": \"23.59.247.10\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"isrg.trustid.ocsp.identrust.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 1398, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"FRfFoq3hSZkdCNDf9l\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245654.396334, \"uid\": \"CWo4pd1z97XLB2o0h2\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56486, \"id.resp_h\": \"23.59.247.122\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"isrg.trustid.ocsp.identrust.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 1398, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"FvQehf1pRsGmwDUzJe\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245692.72884, \"uid\": \"CxFQzh2ePtsnQhFNX3\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56527, \"id.resp_h\": \"23.59.247.10\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"isrg.trustid.ocsp.identrust.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 1398, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"FIeFj8WWNyhA1psGg\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245701.693971, \"uid\": \"CPZSNk1Y6kDvAN0KZ8\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56534, \"id.resp_h\": \"23.59.247.122\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"isrg.trustid.ocsp.identrust.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 1398, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"F0fGHe4RPuNBhYWNv6\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245707.848088, \"uid\": \"Cnab6CHFOprdppKi5\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56542, \"id.resp_h\": \"23.59.247.122\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"isrg.trustid.ocsp.identrust.com\", \"uri\": \"/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFG/0aE1DEtJIYoGcwCs9Rywdii+mBBTEp7Gkeyxx+tvhS5B1/8QVYIWJEAIQCgFBQgAAAVOFc2oLheynCA==\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"com.apple.trustd/2.0\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 1398, \"status_code\": 200, \"status_msg\": \"OK\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": [\"FgDBep1h7EPHC8qQB6\"], \"resp_filenames\": null, \"resp_mime_types\": [\"application/ocsp-response\"]}\n {\"ts\": 1581245952.784242, \"uid\": \"CPNd6t3ofePpdNjErl\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56821, \"id.resp_h\": \"176.31.225.118\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"tracker.trackerfix.com\", \"uri\": \"/announce?info_hash=y\\\\x82es\\\"\\\\x1dV\\\\xde|m\\\\xbe\\\"\\\\xe5\\\\xef\\\\xbe\\\\x04\\\\xb3\\\\x1fW\\\\xfc&peer_id=-qB4210-0ZOn5Ifyl*WF&port=63108&uploaded=0&downloaded=0&left=3225455594&corrupt=0&key=6B23B036&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"-\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 0, \"status_code\": 307, \"status_msg\": \"Temporary Redirect\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": null, \"resp_filenames\": null, \"resp_mime_types\": null}\n {\"ts\": 1581245960.123295, \"uid\": \"CfAkwf2CFI13b24gqf\", \"id.orig_h\": \"192.168.2.108\", \"id.orig_p\": 56889, \"id.resp_h\": \"176.31.225.118\", \"id.resp_p\": 80, \"trans_depth\": 1, \"method\": \"GET\", \"host\": \"tracker.trackerfix.com\", \"uri\": \"/announce?info_hash=!u7\\\\xdad\\\\x94x\\\\xecS\\\\x80\\\\x89\\\\x04\\\\x9c\\\\x13#\\\\x84M\\\\x1b\\\\xcd\\\\x1a&peer_id=-qB4210-i36iloGe*QT9&port=63108&uploaded=0&downloaded=0&left=1637966572&corrupt=0&key=ECE6637E&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0\", \"referrer\": \"-\", \"version\": \"1.1\", \"user_agent\": \"-\", \"origin\": \"-\", \"request_body_len\": 0, \"response_body_len\": 0, \"status_code\": 307, \"status_msg\": \"Temporary Redirect\", \"info_code\": null, \"info_msg\": \"-\", \"tags\": [], \"username\": \"-\", \"password\": \"-\", \"proxied\": null, \"orig_fuids\": null, \"orig_filenames\": null, \"orig_mime_types\": null, \"resp_fuids\": null, \"resp_filenames\": null, \"resp_mime_types\": null}\n\nHow to Load/Parse a Log File?\n-----------------------------\n\nTo load (parse) a log file generically, i.e. when you don't know what format\nthe log file is, you can simple call the ``~zlogging.loader.parse``,\n``zlogging.loader.loads`` functions::\n\n # to parse log at filename\n >>> parse('path/to/log')\n # to load log from a file object\n >>> with open('path/to/log', 'rb') as file:\n ... load(file)\n # to load log from a string\n >>> with open('/path/to/log', 'rb') as file:\n ... loads(file.read())\n\n.. note::\n\n ``zlogging.loader.load``, the file object must be opened\n in binary mode.\n\n ``zlogging.loader.loads``, if the ``data`` suplied is an\n encoded string (``str``), the function will first try to decode it as a\n bytestring (``bytes``) with ``'ascii'`` encoding.\n\nIf you do know the format, you may call the specified functions for each\n``zlogging.loader.parse_ascii`` and ``zlogging.loader.parse_json``, etc.\n\nIf you would like to customise your own parser, just subclass\n``zlogging.loader.BaseParser`` and implement your own ideas.\n\nHow to Dump/Write a Log File?\n-----------------------------\n\nBefore dumping (writing) a log file, you need to create a log **data model**\nfirst. Just like in the Bro/Zeek script language, when customise logging, you\nneed to notify the logging framework with a new log stream. Here, in\n``ZLogging``, we introduced **data model** for the same purpose.\n\nA **data model** is a subclass of ``zlogging.model.Model`` with fields\nand data types declared. A typical **data model** can be as following::\n\n class MyLog(Model):\n field_one = StringType()\n field_two = SetType(element_type=PortType)\n\nwhere ``field_one`` is ``string`` type, i.e. ``zlogging.types.StringType``;\nand ``field_two`` is ``set[port]`` types, i.e. ``zlogging.types.SetType``\nof ``zlogging.types.PortType``.\n\nOr you may use type annotations as `PEP 484`_ introduced when declaring **data models**.\nAll available type hints can be found in ``zlogging.typing``::\n\n class MyLog(Model):\n field_one: zeek_string\n field_two: zeek_set[zeek_port]\n\nAfter declaration of your **data model**, you can know dump (write) your log\nfile with the corresponding functions.\n\nIf you would like to customise your own writer, just subclass\n``zlogging.loader.BaseWriter`` and implement your own ideas.\n\n.. _PEP 484:\n https://www.python.org/dev/peps/pep-0484/\n\n.. [1] https://blog.zeek.org/2018/10/renaming-bro-project_11.html\n",
"bugtrack_url": null,
"license": "BSD 3-Clause License",
"summary": "zlogging: Bro/Zeek logging framework for Python.",
"version": "0.1.3.post2",
"project_urls": {
"changelog": "https://github.com/JarryShaw/zlogging/releases",
"documentation": "https://jarryshaw.github.io/zlogging/",
"homepage": "https://jarryshaw.github.io/zlogging/",
"repository": "https://github.com/JarryShaw/zlogging"
},
"split_keywords": [
"bro",
"zeek",
"logging"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "8039dab624fd0a4a280dd53262fd20083d3ddd018fc7b0d88a42482f0418e8ce",
"md5": "5c1c58db4c5249c4aff39038d67e95d4",
"sha256": "2029fb230945043e33fe62797e60551df310a402f77e554e8bb911d8771d9153"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-cp310-none-any.whl",
"has_sig": false,
"md5_digest": "5c1c58db4c5249c4aff39038d67e95d4",
"packagetype": "bdist_wheel",
"python_version": "cp310",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:11",
"upload_time_iso_8601": "2024-03-16T10:15:11.392775Z",
"url": "https://files.pythonhosted.org/packages/80/39/dab624fd0a4a280dd53262fd20083d3ddd018fc7b0d88a42482f0418e8ce/zlogging-0.1.3.post2-cp310-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "6f3ad0ece8302bee3aca63768bc6cc34c1e48358458b494d7df24bf85e548b27",
"md5": "12930ce5c33eb19666574c65cdb8ed37",
"sha256": "79ad01f167c6c7898ccd8b7bc40fa07086f3fd8d092d771d7764f8efcad0fc43"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-cp311-none-any.whl",
"has_sig": false,
"md5_digest": "12930ce5c33eb19666574c65cdb8ed37",
"packagetype": "bdist_wheel",
"python_version": "cp311",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:09",
"upload_time_iso_8601": "2024-03-16T10:15:09.672962Z",
"url": "https://files.pythonhosted.org/packages/6f/3a/d0ece8302bee3aca63768bc6cc34c1e48358458b494d7df24bf85e548b27/zlogging-0.1.3.post2-cp311-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "d394d4f55118d531fa6bf9796aba809e01e09996b8d1c272277708324c727cf5",
"md5": "45f22a67e62de6d240228c927010ca24",
"sha256": "9776cf609d370ee76b5c4575e2ccb7d81b56c9917df452814a8c9ca704fe1ed9"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-cp38-none-any.whl",
"has_sig": false,
"md5_digest": "45f22a67e62de6d240228c927010ca24",
"packagetype": "bdist_wheel",
"python_version": "cp38",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:12",
"upload_time_iso_8601": "2024-03-16T10:15:12.852878Z",
"url": "https://files.pythonhosted.org/packages/d3/94/d4f55118d531fa6bf9796aba809e01e09996b8d1c272277708324c727cf5/zlogging-0.1.3.post2-cp38-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "20a88f5e3edc5491545b12b2ea02e05d5e5ed652556ee062dcb30429a5f90a7e",
"md5": "7aae9829ff604313eb2753972dd7d13a",
"sha256": "385b2880b0b582ba3b219fa6dae618d84e41826c908bdd0d2f36a416d87d3ce4"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-cp39-none-any.whl",
"has_sig": false,
"md5_digest": "7aae9829ff604313eb2753972dd7d13a",
"packagetype": "bdist_wheel",
"python_version": "cp39",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:15",
"upload_time_iso_8601": "2024-03-16T10:15:15.295058Z",
"url": "https://files.pythonhosted.org/packages/20/a8/8f5e3edc5491545b12b2ea02e05d5e5ed652556ee062dcb30429a5f90a7e/zlogging-0.1.3.post2-cp39-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "56d8f660bc13677c804de0d7ec6cd03e5e2dfe0594abbdc412ade1f2808f7fb0",
"md5": "018b429dadea727a24a26a052ca2884b",
"sha256": "bd2546b9726c5e446e0004c4406264e0ff5db730550da54ee4cfa9bb2cc99ec5"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-pp38-none-any.whl",
"has_sig": false,
"md5_digest": "018b429dadea727a24a26a052ca2884b",
"packagetype": "bdist_wheel",
"python_version": "pp38",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:30",
"upload_time_iso_8601": "2024-03-16T10:15:30.953481Z",
"url": "https://files.pythonhosted.org/packages/56/d8/f660bc13677c804de0d7ec6cd03e5e2dfe0594abbdc412ade1f2808f7fb0/zlogging-0.1.3.post2-pp38-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "990a1c5ba55081b3e4f0a45764e5c4ead3edd02ca47812aad925574c263888f2",
"md5": "00392cc56ae1e5860586dc531a39951f",
"sha256": "6bac8bd5fb0b75f57bb1134560dde2e56d853ab1aafefff15f84a528ee50d325"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2-pp39-none-any.whl",
"has_sig": false,
"md5_digest": "00392cc56ae1e5860586dc531a39951f",
"packagetype": "bdist_wheel",
"python_version": "pp39",
"requires_python": "<4,>=3.6",
"size": 78622,
"upload_time": "2024-03-16T10:15:28",
"upload_time_iso_8601": "2024-03-16T10:15:28.515519Z",
"url": "https://files.pythonhosted.org/packages/99/0a/1c5ba55081b3e4f0a45764e5c4ead3edd02ca47812aad925574c263888f2/zlogging-0.1.3.post2-pp39-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "9fa5991221dcb6673abb06d5ffca8caa4ae9fbd8125625b2550b43dafebfc83e",
"md5": "28f53ce13fe4194d86be9d7aa70c09eb",
"sha256": "a650c409f1c61691474da92f69af319551e0838eafc20f938ede6682e03d74f6"
},
"downloads": -1,
"filename": "zlogging-0.1.3.post2.tar.gz",
"has_sig": false,
"md5_digest": "28f53ce13fe4194d86be9d7aa70c09eb",
"packagetype": "sdist",
"python_version": "source",
"requires_python": "<4,>=3.6",
"size": 78514,
"upload_time": "2024-03-16T10:15:12",
"upload_time_iso_8601": "2024-03-16T10:15:12.110074Z",
"url": "https://files.pythonhosted.org/packages/9f/a5/991221dcb6673abb06d5ffca8caa4ae9fbd8125625b2550b43dafebfc83e/zlogging-0.1.3.post2.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-03-16 10:15:12",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "JarryShaw",
"github_project": "zlogging",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"tox": true,
"lcname": "zlogging"
}
