base/protocols/syslog/main.zeek¶
-
Syslog¶
Core script support for logging syslog messages. This script represents one syslog message as one logged record.
| Namespace: | Syslog |
|---|---|
| Imports: | base/protocols/syslog/consts.zeek |
Summary¶
Types¶
Syslog::Info: record |
The record type which contains the fields of the syslog log. |
Redefinitions¶
Log::ID: enum |
|||
connection: record |
|
||
likely_server_ports: set &redef |
Detailed Interface¶
Types¶
-
Syslog::Info¶ Type: - ts:
time&log Timestamp when the syslog message was seen.
- uid:
string&log Unique ID for the connection.
- id:
conn_id&log The connection’s 4-tuple of endpoint addresses/ports.
- proto:
transport_proto&log Protocol over which the message was seen.
- facility:
string&log Syslog facility for the message.
- severity:
string&log Syslog severity for the message.
- message:
string&log The plain text message.
The record type which contains the fields of the syslog log.
- ts:
Hooks¶
-
Syslog::log_policy¶ Type: Log::PolicyHook