diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 18 |
1 files changed, 6 insertions, 12 deletions
@@ -13,18 +13,12 @@ Options: -v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) -V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) -W, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) --P, --pings Print only "empty pings" --F, --fails Print only failed logins --L, --logins Print only "login pings" --C, --commands Print only "command pings" --E, --eventful Print only the cool interesting sessions that aren't any of that other stuff. +-P, --pings Include only connections where no authentication attempt was made +-F, --fails Include only failed logins +-L, --logins Include only successful logins where no commands were run +-C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc', 'echo'] +-E, --eventful Include only the cool interesting sessions that aren't any of that other stuff -r, --redact-ip Redact IP addresses by converting them to 16-character hashes -i, --filter-ip FILTER_IP Filter data to a specific IP or censored hash thereof -``` - -# Terminology - -- "Empty ping": Client connected and made no attempt to log in -- "Login ping": Client logged in successfully and did nothing -- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands
\ No newline at end of file +```
\ No newline at end of file |