LogLens/tests/fixtures/parser_matrix/noisy_auth_expected.json at main · stacknil/LogLens · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
{
  "fixture": "assets/noisy_auth_sample.log",
  "input_mode": "syslog_legacy",
  "assume_year": 2026,
  "total_input_lines": 27,
  "total_lines": 24,
  "skipped_blank_lines": 3,
  "parsed_lines": 8,
  "unparsed_lines": 16,
  "parse_success_rate": 0.3333333333,
  "parsed_event_count": 8,
  "warning_count": 16,
  "top_unknown_patterns": [
    {"pattern": "pam_faillock_account_locked", "count": 2},
    {"pattern": "pam_unix_session_closed", "count": 2},
    {"pattern": "sshd_connection_closed_preauth", "count": 2},
    {"pattern": "sshd_negotiation_failure", "count": 2},
    {"pattern": "sshd_timeout_or_disconnection", "count": 2}
  ],
  "failure_categories": [
    {"category": "known_program_unknown_message", "count": 7},
    {"category": "unsupported_pam_variant", "count": 5},
    {"category": "unknown_timestamp", "count": 3},
    {"category": "unknown_program", "count": 1}
  ],
  "warnings": [
    {"line_number": 1, "category": "unknown_timestamp", "reason": "invalid time token"},
    {"line_number": 2, "category": "unknown_timestamp", "reason": "invalid calendar date"},
    {"line_number": 13, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 14, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 15, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"},
    {"line_number": 16, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"},
    {"line_number": 17, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_negotiation_failure"},
    {"line_number": 18, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_negotiation_failure"},
    {"line_number": 19, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 20, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_unix_session_closed"},
    {"line_number": 21, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_faillock_account_locked"},
    {"line_number": 22, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_faillock_account_locked"},
    {"line_number": 23, "category": "unsupported_pam_variant", "reason": "unrecognized auth pattern: pam_sss_unknown_user"},
    {"line_number": 24, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sudo_other"},
    {"line_number": 26, "category": "unknown_timestamp", "reason": "missing syslog header fields"},
    {"line_number": 27, "category": "unknown_program", "reason": "unrecognized auth pattern: program_cron"}
  ]
}