Skip to content

Commit

Permalink
Upgrade to CEF parser 0.0.1.10 (#24)
Browse files Browse the repository at this point in the history
OSSEC is using a "degraded" syslog format without hostname field.

Fixes #23
  • Loading branch information
joschi authored Nov 15, 2017
1 parent 0f93a59 commit b12ac0e
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 1 deletion.
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
<dependency>
<groupId>org.graylog.cef</groupId>
<artifactId>cef-parser</artifactId>
<version>0.0.1.9</version>
<version>0.0.1.10</version>
</dependency>
<dependency>
<groupId>org.graylog2</groupId>
Expand Down
20 changes: 20 additions & 0 deletions src/test/resources/fixtures/issue_23_comment_343792271.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"testString": "<132>Nov 13 13:17:41 CEF:0|Trend Micro Inc.|OSSEC HIDS|v2.9.2|1002|Unknown problem somewhere in the system.|2|dvc=log cs1=(proxy) any->/var/log/syslog cs1Label=Location classification= syslog,errors, msg=Nov 13 13:17:39 proxy tinyproxy[26954]: readbuff: recv() error \"Connection reset by peer\" on file descriptor 6",
"description": "https://github.com/Graylog2/graylog-plugin-cef/issues/23#issuecomment-343792271",
"remoteAddress": "127.0.0.1",
"expectedSource": "log",
"cefVersion": 0,
"deviceVendor": "Trend Micro Inc.",
"deviceProduct": "OSSEC HIDS",
"deviceVersion": "v2.9.2",
"deviceEventClassId": "1002",
"name": "Unknown problem somewhere in the system.",
"severity": "2",
"extensions": {
"level": 4,
"facility": "local0",
"Location": "(proxy) any->/var/log/syslog",
"classification": "syslog,errors,",
"msg": "Nov 13 13:17:39 proxy tinyproxy[26954]: readbuff: recv() error \"Connection reset by peer\" on file descriptor 6"
}
}

0 comments on commit b12ac0e

Please sign in to comment.