Skip to content

Update Checkpoint parser#325

Open
KGuillemot wants to merge 2 commits intorsyslog:masterfrom
VultureProject:PR-Checkpoint
Open

Update Checkpoint parser#325
KGuillemot wants to merge 2 commits intorsyslog:masterfrom
VultureProject:PR-Checkpoint

Conversation

@KGuillemot
Copy link
Contributor

Update Checkpoint parser to parse newest format with quoted strings, for example :
[action:"Accept"; dst:"192.168.1.2"; product:"FireWall"; src:"192.168.1.3"; ]

@KGuillemot
Copy link
Contributor Author

Hello,
Do you know what is going on concerning the tests failures ?

@solhuebner
Copy link
Contributor

Also, have a look at #234 as it is meant to fix the no quotes support so that we do not try to fix it in different ways

@KGuillemot
Copy link
Contributor Author

Also, have a look at #234 as it is meant to fix the no quotes support so that we do not try to fix it in different ways

Hello,
No, it's a different parser.

@rgerhards
Copy link
Member

Top go forward, the CI failures must be fixed. I guess they indicate a backwards.-incompatible changed happened.

As of today, Checkpoint logs do not necessarily provide a semicolon
between the last key:value pair and the terminator.
This causes the parse to fail with current behavior.
@frikilax frikilax mentioned this pull request Oct 12, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments