ELF > @ 0I @ 8 @ H H 0 0 0 0= 0M 0M H= HM HM $ $ Std Ptd 45 45 45 Qtd Rtd 0= 0M 0M GNU GNU hNW> L' Ys U Z m f z s , F "
p __gmon_start__ _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize free r_dbgprintf strcmp Debug malloc nvlstGetParams cnfparamvalsDestruct es_str2cstr cnfparamsPrint calloc strlen strncasecmp memmove modInit loadConf __stack_chk_fail libcap-ng.so.0 libc.so.6 pmsnare.so GLIBC_2.4 GLIBC_2.2.5 ii
! ui + 0M 8M ` @M @M S h2 S 1 S 2 S @2 S S O O O O O O `O hO pO xO O O O
O O
O O O O O HH? HtH 5*? %+? h h h h h h h h q h a h Q h
A h 1 h ! h
%E> D %=> D %5> D %-> D %%> D % > D %> D %
> D %> D %= D %= D %= D %= D %= D H=A HA H9tH= Ht H=A H5A H)HH?HHHtH= Htf D =eA u+UH== Ht H=: Yd=A ] w 1 1 H% H1ff. @ H H1ff. @ 1f %-ff. 1f 1f 1f UH- 1H
= HH5 {= H1H
< H5} b= H1H
F< H5k I= 1] D HH1ff. @ ATL%? UHSI $Ht D HH[ HuLHtH[1]A\ UHH1H5L H= HtH1]ff. @ AWAVAUATUSHH IH H L H1LL= L5L- LL
X HLIDI $vH
L> HLHDI $SHLHHDI $7H5 HIDI $ H5 HH HDI $H5 HHK HDI $H5 HHHDI $H5 HHHDI $LHHHDI $H5 HHHDI $bL HH LHDI $?L8L
HLIDI $ H
uL HLHDI $H2LHHDI $H5
HIDI $H5 HHa HDI $H5 HHHDI $H5 HH HDI $dH5 HHHDI $DLHHHDI $(AŅt1H5 Ht HH rsyslog.snare pmsnare glbl pmsnare.c parser datetime modExit modGetID getType getKeepType beginCnfLoad endCnfLoad checkCnf activateCnf freeCnf getModCnfName setModCnf parse2 GetParserName newParserInst checkParserInst freeParserInst isCompatibleWithFeature newParserInst (pmsnare)
pmsnare: parser param blk:
pmsnare: Begin endCnfLoad
MSWinEventLog LinuxKAudit objGetObjInterface regCfSysLineHdlr 8.2510.0-2.el9 pmsnare: free parser instance %p
entry point '%s' not present in module
parser.escapecontrolcharactersonreceive parser.escapecontrolcharactertab parser.escapecontrolcharacterscstyle parser.controlcharacterescapeprefix pmsnare: program error, non-handled param '%s'
pmsnare: Snare parser will treat '%s' as tab.
Message will now be parsed by fix Snare parser.
pmsnare: msg to look at: [%d]'%s'
pmsnare: Message is too short to be Snare!
pmsnare: tab separated message
pmsnare: tab [%d]'%s' msg at the first separator: [%d]'%s'
Found a non-syslog Windows Snare message.
Found a non-syslog Linux Snare message.
Found a syslog Windows Snare message.
pmsnare: Found a syslog Linux Snare message.
pmsnare: new message: [%d]'%s'
pmsnare: tab [%d]'%s' msg after the timestamp and hostname: [%d]'%s'
snare parser init called, compiled with version %s
; | 4 H \ p , < L8 L 8 < zR x $ FJ w ?:*3$" D \ h
p d
` l x t | x t[ EU , ( @ M FHD uCB l 1 Ek H X FBB B(A0A8D@
8D0A(B BBBE H FBB B(D0A8DP9
8D0A(B BBBE ( tF EIL ^
DAA 8 L E FKA H(G0(C ABB H M FNE I(D0A8DP
8F0A(B BBBK 8 FLA D(G@
(D ABBI ` @M
! 0M 8M o
7 HO P P o o x o o H o HM 0 @ P ` p
h2
1 2 @2 S pmsnare.so-8.2510.0-2.el9.x86_64.debug *?57zXZ ִF ! t/] ?Eh=ڊ2N 1nW ,:Hc9]! v"QaDp! .E"`JP$^Ս_6: z.ݳV/M
*И!XQ%.s'ljɡ9
;lfgpaddf5Zs'd
&џq!}8>xOTPio}.meӵ;2ih` YȘv: !.T t
* R; > Sc-.d!C`wtTBMh:3BܤD/~Jr JpF)F;KQ bNwrܺCu ;V6bSh_^8y\/MDWyEoŮVXPba`Z
v\LC}R I7?f&'p,> ܪ'. &-OH[2r'0_̲";nS;"C?QЗYEMH@ nBCW_;I_zvWcFzoR3@^_}kM0(Mj3dg]H>bCh' c 1fgG||ALɡ|%>dd7)iG-'P C; ('kq l{U# ';| ! D g YZ .shstrtab .note.gnu.property .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .data.rel.ro .dynamic .got .data .bss .gnu_debuglink .gnu_debugdata $ 1 o $ ; C 7 K o H H * X o x x 0 g P q B P { v ! !
2 0 0 4 45 45 5 5 0M 0= 8M 8= @M @= HM H= HO H? P @ S C C , C H