From 0deb8ecec9b874d58f6c46f6351d401464d1c061 Mon Sep 17 00:00:00 2001 From: Ada Isopods Date: Fri, 16 May 2025 06:21:20 -0600 Subject: you don't need to see my wacky internal terminology for a simple log analyzing tool --- README.md | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index f0fe695..ee60abf 100644 --- a/README.md +++ b/README.md @@ -13,18 +13,12 @@ Options: -v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) -V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) -W, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) --P, --pings Print only "empty pings" --F, --fails Print only failed logins --L, --logins Print only "login pings" --C, --commands Print only "command pings" --E, --eventful Print only the cool interesting sessions that aren't any of that other stuff. +-P, --pings Include only connections where no authentication attempt was made +-F, --fails Include only failed logins +-L, --logins Include only successful logins where no commands were run +-C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc', 'echo'] +-E, --eventful Include only the cool interesting sessions that aren't any of that other stuff -r, --redact-ip Redact IP addresses by converting them to 16-character hashes -i, --filter-ip FILTER_IP Filter data to a specific IP or censored hash thereof -``` - -# Terminology - -- "Empty ping": Client connected and made no attempt to log in -- "Login ping": Client logged in successfully and did nothing -- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands \ No newline at end of file +``` \ No newline at end of file -- cgit v1.2.3