Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[endlessh] Add endlessh-go compatbility to parser #1035

Closed
Swiiney opened this issue May 1, 2024 · 1 comment · Fixed by #1057
Closed

[endlessh] Add endlessh-go compatbility to parser #1035

Swiiney opened this issue May 1, 2024 · 1 comment · Fixed by #1057

Comments

@Swiiney
Copy link

Swiiney commented May 1, 2024

Current endlessh collection uses endlessh C implementation which isn't maintained since 4 years. A new implementation in go is available https://github.com/shizunge/endlessh-go actively developped.
The log is sligthly different and the parser should be adapted.
The docker implementation encourages to log to docker and not to a file. Acquisition document should be adapted too.

Thanks

@LaurenceJJones
Copy link
Contributor

Taken from the provided docker container

I0613 10:21:33.893309       1 main.go:78] Listening on 0.0.0.0:2222
I0613 10:22:09.748256       1 client.go:58] ACCEPT host=192.168.121.1 port=42922 n=1/4096
I0613 10:22:21.684962       1 client.go:58] ACCEPT host=192.168.121.1 port=53598 n=2/4096
I0613 10:22:22.751686       1 client.go:99] CLOSE host=192.168.121.1 port=42922 time=13.00339604 bytes=199
I0613 10:22:26.154722       1 client.go:58] ACCEPT host=192.168.121.1 port=53608 n=2/4096
I0613 10:22:26.686114       1 client.go:99] CLOSE host=192.168.121.1 port=53598 time=5.001109157 bytes=52
I0613 10:22:31.156118       1 client.go:99] CLOSE host=192.168.121.1 port=53608 time=5.001370007 bytes=64
I0613 10:22:39.811136       1 client.go:58] ACCEPT host=192.168.121.1 port=50512 n=1/4096

i will ask the team if we want to split these or just class it all as endlessh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants