Log2t::input::selinux(3)

NAME
selinux - a parser for SELinux audit files

DESCRIPTION
SELinux Audit files could provide relevant information to analysts. This module parses the audit.log files extracting timestamp and message from log's lines.

METHODS

  "new"
Module constructor.

Returns:

An instance of the class.

  "get_version"
A simple subroutine that returns the version number of the input module.

Returns:

A string representing the version number.

  "get_description"
A simple subroutine that returns a string containing a description of the funcionality of the input module. This string is used when a list of all available input modules is printed out.

Returns:

A string containing a description of the input module.

  "get_time"
The subroutine parses a single log line, extracting the timestamp and the message part. It tries to fill some other fields like user, application and so on. (TODO: a better explanation is required).

  "get_help"
A simple subroutine that returns a string containing the help message for this particular input module.

Returns:

A string containing a help description for this input module.

  "verify"
The module verify subroutine makes these checks to understand if it's the right file: - check if input it's a file (correct) or a directory (wrong) - check name: if the name includes 'audit*.log'
  Note that renamed files and ARCHIVED files (tgz) will be skipped! - check the first 5 bytes if they contain "type=" - check if the " msg=audit(1337845201.174:94983):" is present

Returns:

A reference to a hash that contains two keys/values.

success -> INT, either 0 or 1 (meaning not the correct structure, or the correct one) msg -> A short description why the verification failed (if the value of success is zero that is).