Comments on: log2timeline updated

By: kiddi

kiddi — Fri, 12 Mar 2010 18:40:05 +0000

Hi,
thank you for this comment, I’ve added it in my code already. The log files that I had in my hands had the 03 notion for month that was earlier than October, so obviously they can “swing” both ways

By: Paul Bobby

Paul Bobby — Fri, 12 Mar 2010 15:52:53 +0000

I changed line 697 to

if( $words[0] =~ m/d{1,2}/d{1,2}/d{4}/ )

the month field can be 1 or 2 characters also

By: Paul Bobby

Paul Bobby — Thu, 11 Mar 2010 20:07:27 +0000

When running log2timeline with the mcafee option I get the following:

pbobby@ubuntu:~/Documents/log2timeline$ log2timeline -z US/Eastern -f mcafee ./fred/AccessProtectionLog.txt
Start processing file/dir [./fred/AccessProtectionLog.txt] …
Loading output file: mactime
Starting to parse file using format: [mcafee]
This is a plugin of unkown origin. It parses a log file and contains no requirements or
any other relevant options or possibilites, use with care…
————————

File ./fred/AccessProtectionLog.txt is not of the right format.
Error given from format file: The date field is not correctly formed(10/4/2009)

————————

Usage:
log2timeline [OPTIONS] -f FORMAT LOG_FILE/LOG_DIR [--] [FORMAT FILE
OPTIONS]

pbobby@ubuntu:~/Documents/log2timeline$

By: Paul Bobby

Paul Bobby — Thu, 11 Mar 2010 20:06:43 +0000

Here’s the first line of my AP log file.

10/4/2009 7:36:10 PM Would be blocked by port blocking rule (rule is currently not enforced) C:Documents and SettingspbobbyLocal SettingsApplication DataGoogleChromeApplicationchrome.exe Common Maximum Protection:Prevent HTTP communication 8.5.0.232:80

By: John Jarvis

John Jarvis — Sat, 06 Mar 2010 16:46:30 +0000

Great news about its inclusion in the next version of SIFT. Thanks for this, Kristinn; great tool!