{"action":"created","issue":{"url":"https://api.github.com/repos/activecm/rita/issues/333","repository_url":"https://api.github.com/repos/activecm/rita","labels_url":"https://api.github.com/repos/activecm/rita/issues/333/labels{/name}","comments_url":"https://api.github.com/repos/activecm/rita/issues/333/comments","events_url":"https://api.github.com/repos/activecm/rita/issues/333/events","html_url":"https://github.com/activecm/rita/issues/333","id":395381580,"node_id":"MDU6SXNzdWUzOTUzODE1ODA=","number":333,"title":"Recognize compatible logs (http vs http_eth0)","user":{"login":"ethack","id":1696711,"node_id":"MDQ6VXNlcjE2OTY3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/1696711?v=4","gravatar_id":"","url":"https://api.github.com/users/ethack","html_url":"https://github.com/ethack","followers_url":"https://api.github.com/users/ethack/followers","following_url":"https://api.github.com/users/ethack/following{/other_user}","gists_url":"https://api.github.com/users/ethack/gists{/gist_id}","starred_url":"https://api.github.com/users/ethack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ethack/subscriptions","organizations_url":"https://api.github.com/users/ethack/orgs","repos_url":"https://api.github.com/users/ethack/repos","events_url":"https://api.github.com/users/ethack/events{/privacy}","received_events_url":"https://api.github.com/users/ethack/received_events","type":"User","site_admin":false},"labels":[{"id":975921421,"node_id":"MDU6TGFiZWw5NzU5MjE0MjE=","url":"https://api.github.com/repos/activecm/rita/labels/bug","name":"bug","color":"e11d21","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/activecm/rita/milestones/4","html_url":"https://github.com/activecm/rita/milestone/4","labels_url":"https://api.github.com/repos/activecm/rita/milestones/4/labels","id":3880651,"node_id":"MDk6TWlsZXN0b25lMzg4MDY1MQ==","number":4,"title":"v2.0.0","description":"","creator":{"login":"ethack","id":1696711,"node_id":"MDQ6VXNlcjE2OTY3MTE=","avatar_url":"https://avatars3.githubusercontent.com/u/1696711?v=4","gravatar_id":"","url":"https://api.github.com/users/ethack","html_url":"https://github.com/ethack","followers_url":"https://api.github.com/users/ethack/followers","following_url":"https://api.github.com/users/ethack/following{/other_user}","gists_url":"https://api.github.com/users/ethack/gists{/gist_id}","starred_url":"https://api.github.com/users/ethack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ethack/subscriptions","organizations_url":"https://api.github.com/users/ethack/orgs","repos_url":"https://api.github.com/users/ethack/repos","events_url":"https://api.github.com/users/ethack/events{/privacy}","received_events_url":"https://api.github.com/users/ethack/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":5,"state":"open","created_at":"2018-12-07T18:18:15Z","updated_at":"2019-01-02T21:12:07Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2019-01-02T21:11:15Z","updated_at":"2019-01-02T21:48:13Z","closed_at":null,"author_association":"COLLABORATOR","body":"In some cases, Bro will generate log files with differences that cause RITA to miss parsing them.  I only have one example right now, but I don't know there aren't others.\r\n\r\nFor http logs the names are normally:\r\n```\r\nhttp.01:00:00-02:00:00.log.gz\r\n```\r\n\r\nBut with Security Onion and multiple interfaces the names can come out like this:\r\n```\r\nhttp_eth0.00:00:00-01:00:00.log.gz\r\n```\r\n\r\nThe name doesn't make a difference, but in the file header the following line is different and appears to cause RITA to skip the `_eth0` variant.\r\n```\r\n#path   http\r\n```\r\n\r\nvs.\r\n\r\n```\r\n#path   http_eth0\r\n```\r\n\r\nThe following code path seems to be the culprit.\r\n- The `path` value gets stored in the `BroHeader` struct [ref](https://github.com/activecm/rita/blob/v2.0.0-beta1/parser/fileparsetypes/fileparsetypes.go#L19)\r\n- This is where the code stores the value [ref](https://github.com/activecm/rita/blob/v2.0.0-beta1/parser/fileparser.go#L71)\r\n- This is where RITA creates the correct file parser based on the `path` value [ref](https://github.com/activecm/rita/blob/v2.0.0-beta1/parser/indexedfile.go#L59)\r\n- And finally, this is the function that simply compares the `path` value against some static strings to determine the type of BroData to use [ref](https://github.com/activecm/rita/blob/v2.0.0-beta1/parser/parsetypes/parsetypes.go#L15)\r\n"},"comment":{"url":"https://api.github.com/repos/activecm/rita/issues/comments/450995623","html_url":"https://github.com/activecm/rita/issues/333#issuecomment-450995623","issue_url":"https://api.github.com/repos/activecm/rita/issues/333","id":450995623,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDk5NTYyMw==","user":{"login":"william-stearns","id":3538265,"node_id":"MDQ6VXNlcjM1MzgyNjU=","avatar_url":"https://avatars2.githubusercontent.com/u/3538265?v=4","gravatar_id":"","url":"https://api.github.com/users/william-stearns","html_url":"https://github.com/william-stearns","followers_url":"https://api.github.com/users/william-stearns/followers","following_url":"https://api.github.com/users/william-stearns/following{/other_user}","gists_url":"https://api.github.com/users/william-stearns/gists{/gist_id}","starred_url":"https://api.github.com/users/william-stearns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/william-stearns/subscriptions","organizations_url":"https://api.github.com/users/william-stearns/orgs","repos_url":"https://api.github.com/users/william-stearns/repos","events_url":"https://api.github.com/users/william-stearns/events{/privacy}","received_events_url":"https://api.github.com/users/william-stearns/received_events","type":"User","site_admin":false},"created_at":"2019-01-02T21:48:13Z","updated_at":"2019-01-02T21:48:13Z","author_association":"NONE","body":"Please make the fix portable so that any interface name will be recognized.  The characters between underscore and period can include at least upper and lowercase letters, colon, and digits.  "}}
{"actor":{"display_login":"william-stearns"}}