arunk-s

# backup.sh
# The contents of this file are released under the GNU General Public License. Feel free to reuse the contents of this work, as long as the resultant works give proper attribution and are made publicly available under the GNU General Public License.
# By Arun Sori <[email protected]>

#For taking backup of the desired directory and store it at a remote place

#timestamp
time_stamp=`date`

#backup file name 

arunk-s

[hekad]
maxprocs = 4 

# Nginx access log reader
[Nginxserver]
type = "LogstreamerInput"
log_directory = "/var/log/nginx"
file_match = 'access\.log'
decoder = "CombinedNginxDecoder"

arunk-s

#include <tuple>
#include <boost/chrono/date/algorithms/weekday_from_days.hpp>
#include <boost/chrono/date/algorithms/days_from_civil.hpp>
#include <boost/chrono/date/algorithms/civil_from_days.hpp>



    days_date::days_date(chrono::year y, chrono::month m, chrono::day d) BOOST_NOEXCEPT
    {
      x_ = days_from_civil(y,m,d) //Passing opaque has better performance results      

arunk-s

1. Execute make first. This will result in a netlinkKernel.ko output among many others.
2. Execute $ gcc netlinkUser.c -o netlinkUser
3. Insert kernel module by :$ sudo insmod netlinkKernel.ko      
4. Run ./netlinkUser to see message and run dmesg to see debug messages
5. Remove module by : $ sudo rmmod netlinkKernel          
6. Finally make clean to remove output files.

arunk-s

execve("/usr/bin/go", ["go", "run", "netlink.go"], [/* 39 vars */]) = 0
brk(0)                                  = 0x227c000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7feea8392000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=124620, ...}) = 0
mmap(NULL, 124620, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7feea8373000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)

arunk-s

package main

import (
	//	"encoding/binary"
	"fmt"
	"syscall"
	"unsafe"
)

const (

arunk-s

package main

/*
#cgo CFLAGS: -Wall
#cgo LDFLAGS: -L . -laudit

#include <libaudit.h>
*/
import "C"

arunk-s

package main

import (
	"./netlinkAudit"
	"log"
	"os"
	"syscall"
	"time"
)

arunk-s

package netlinkAudit

import (
	"bytes"
	"encoding/binary"
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"log"

arunk-s

START = line | 

register_name = "eax" | "ebx" | "ecx" | "edx"
label = +([\w]) ":"
inst_mov = "mov " register_name "," register_name,
				| "mov " register_name "," +([\d])
inst_add = "add " register_name "," register_name,
				| "add " register_name "," +([\d])
inst_jmp = "jmp " +([\w])