LogLens/assets/mixed_auth_parser_coverage.json at main · stacknil/LogLens · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
{
  "artifact": "loglens.parser_coverage_sample",
  "schema_version": 1,
  "fixture": "assets/mixed_auth_corpus.log",
  "input_mode": "syslog_legacy",
  "assume_year": 2026,
  "parser_quality": {
    "total_input_lines": 160,
    "total_lines": 150,
    "skipped_blank_lines": 10,
    "parsed_lines": 100,
    "unparsed_lines": 50,
    "parse_success_rate": 0.6666666667,
    "top_unknown_patterns": [
      {"pattern": "invalid_month_token", "count": 10},
      {"pattern": "malformed_source_ip", "count": 10},
      {"pattern": "pam_unix_session_closed", "count": 10},
      {"pattern": "program_cron", "count": 10},
      {"pattern": "sshd_connection_closed_preauth", "count": 10}
    ],
    "failure_categories": [
      {"category": "known_program_unknown_message", "count": 10},
      {"category": "malformed_source_ip", "count": 10},
      {"category": "unknown_program", "count": 10},
      {"category": "unknown_timestamp", "count": 10},
      {"category": "unsupported_pam_variant", "count": 10}
    ]
  },
  "parsed_event_count": 100,
  "warning_count": 50,
  "event_type_counts": [
    {"event_type": "ssh_accepted_publickey", "count": 10},
    {"event_type": "ssh_invalid_user", "count": 10},
    {"event_type": "ssh_failed_publickey", "count": 10},
    {"event_type": "pam_auth_failure", "count": 36},
    {"event_type": "session_opened", "count": 4},
    {"event_type": "sudo_command", "count": 10},
    {"event_type": "sudo_auth_failure", "count": 10},
    {"event_type": "su_auth_failure", "count": 10}
  ],
  "warnings": [
    {"line_number": 10, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 11, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 12, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 13, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 14, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 25, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 26, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 27, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 28, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 29, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 40, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 41, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 42, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 43, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 44, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 55, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 56, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 57, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 58, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 59, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 70, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 71, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 72, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 73, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 74, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 85, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 86, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 87, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 88, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 89, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 100, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 101, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 102, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 103, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 104, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 115, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 116, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 117, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 118, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 119, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 130, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 131, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 132, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 133, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 134, "category": "unknown_timestamp", "reason": "invalid month token"},
    {"line_number": 145, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 146, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 147, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"},
    {"line_number": 148, "category": "malformed_source_ip", "reason": "malformed source IP"},
    {"line_number": 150, "category": "unknown_timestamp", "reason": "invalid month token"}
  ]
}