16 lines
4.6 KiB
Plaintext
16 lines
4.6 KiB
Plaintext
|
Êþº¾ 4 ~
|
||
|
|
& A B C D E F G H I J K L M N O
|
||
|
|
P Q
|
||
|
|
R S T
|
||
|
|
A U
|
||
|
|
V
|
||
|
|
W X
|
||
|
|
Y Z [ M \ ] ^
|
||
|
|
_ ` a b c d
|
||
|
|
& e
|
||
|
|
f g h i <init> ()V Code LineNumberTable LocalVariableTable this LSyslogParserDemo; main ([Ljava/lang/String;)V msg !Lcom/common/entity/SyslogMessage; e Ljava/lang/Exception; log Ljava/lang/String; args [Ljava/lang/String; rfc5424Logs rfc3164Logs mixedLogs
|
||
|
|
StackMapTable 7 B [
|
||
|
|
SourceFile SyslogParserDemo.java ' ( java/lang/String q<4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {"title":"HFish Threat Alert","client":"内置节点"} U<34>1 2023-10-27T14:30:15.123Z web-server-01 myapp 1234 ID47 - This is a test message {<165>1 2023-10-27T15:45:30.000+08:00 firewall01 sshd 5678 - [event source="auth" result="failure"] Failed password for user u<14>1 2023-10-27T16:20:45.789Z db-server-01 postgres 9012 DB01 [metrics query_time="150ms" rows=100] SELECT completed}<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - {"source":"honeypot1","id":"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a","start_time":"2023-09-03T11:07:02.50167643Z","time":"2023-09-03T11:16:18.883885281Z","risk_level":4,"connection":"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf","file_info":null,"extra":{"payload":{"format":"line","name":{"cn":"攻击载è�·","en":"payload"},"value":""},"uid":{"format":"line","name":{"cn":"","en":""},"uid":"b4cbc73c-25d0-4429-ae1b-a856cdf1a651","value":""}},"type":"WEB_ATTACK_SCANNER","agent_sn":"caa7da42-0cca-4cb1-b501-1f1eb2b588d5","agent_name":" 教育局蜜ç½�探针","honeypot_id":"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6","honeypot_name":"茂å��市ä¸å°�å¦ç®¡ç�†å¹³å�°ç®¡ç�†å�Žå�°","src_ip":"117.50.189.7","src_port":58512,"src_mac":"","dest_ip":"192.168.222.2","dest_port":9200,"proxy_ip":null,"node":"WRx3"} <4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {"title":"HFish Threat Alert","client":"内置节点","client_ip":"192.168.11.133","attack_type":"attack","scan_type":"","scan_port":"","class":"端å�£ç›‘å�¬","type":"TCP","name":"TCP端å�£ç›‘å�¬","account":"","src_ip":"36.154.189.226","src_port":"29604","dst_ip":"192.168.11.133","dst_port":"445","geo":"ä¸å›½-江è‹�","time":"2025-09-14 16:27:09","threat_name":"","threat_level":"other","info":"36.154.189.226:29604 already connected.","labels":"","labels_cn":"","AuthInfo":null} 9<15>Oct 9 21:15:55 LAPTOP-ARDUR3N0 alan: honeypot_event ><34>Oct 27 14:30:15 web01 sshd[1234]: Failed password for root K<13>Oct 27 15:45:30 firewall01 %ASA-6-302013: Built outbound TCP connection <<7>Oct 27 16:20:45 appserver kernel: USB device disconnected j k l === RFC 5424 æ ¼å¼�解æž� === m n o p q r java/lang/StringBuilder 原始日志: s t u v 解æž�结果: s w --- java/lang/Exception x l 解æž�失败: 错误: y v
|
||
|
|
=== RFC 3164 æ ¼å¼�解æž� === !
|
||
|
|
=== æ··å�ˆæ ¼å¼�自动检测 === @<34>1 2023-10-27T14:30:15.123Z web01 myapp 1234 - - Test RFC5424 .<13>Oct 27 15:45:30 web02 kernel: Test RFC3164 æ£€æµ‹åˆ°æ ¼å¼�: z { | } v SyslogParserDemo java/lang/Object java/lang/System out Ljava/io/PrintStream; java/io/PrintStream println (Ljava/lang/String;)V com/common/util/SyslogParser parse 5(Ljava/lang/String;)Lcom/common/entity/SyslogMessage; append -(Ljava/lang/String;)Ljava/lang/StringBuilder; toString ()Ljava/lang/String; -(Ljava/lang/Object;)Ljava/lang/StringBuilder; err
|
||
|
|
getMessage getClass ()Ljava/lang/Class; java/lang/Class
|