A small library for unified2 parsing in node.js.
$ npm install unified2
var unified2 = require'unified2';parser = 'unified2.alert.14560142132' offset: 0 ;parseron'data'// event data...;parseron'error'// error;parseron'rollover'// triggered when a rollover is detected (the file shrinks in size);parseron'end'// triggered when parser ends (e.g., out of data);parserrun
It is often useful to wait for more data as the file is being written, e.g. by a Snort sensor.
tail: true in the options for the parser to wait for more logs, e.g.:
var unified2 = require'unified2';parser = 'unified2.alert.14560142132' offset: 0 tail: true ;parserrun;
To stop the parser, you can do
parser.stop() which will trigger an end event.
DEBUG=unified2 as an environment variable to turn on debug logging.
Pretty fast! IO is async too, so by parallelizing parsers you can increase performance.
Here's reading ~4.6 MB and writing parsed objects (~34MB) to stdout.
unified2 (master*) $ time node tests/test.js > /tmp/test.js.output ~/src/unified2node tests/test.js > /tmp/test.js 12.16s user 0.84s system 103% cpu 12.621 total
Copyright (C) 2013 Threat Stack, Inc (https://www.threatstack.com)
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.