Log2t::input::utmp(3pm)

NAME
utmp - Linux wtmp/wtmpx/btmp files module parser.

DESCRIPTION
A relevant artifact during Linux exploration are users logins and logouts, both successful and failed. Those information are kept inside wtmp and btmp file respectively, normally found inside the /var/log directory. The module parses the wtmp/wtmpx Linux files with respect to the wtmp(5) specification (a reference here: http://linux.die.net/man/5/wtmp), extracting users logins and logouts. The module can parse btmp files too since the internal format it's the same as wtmp. The check between wtmp and btmp files can be made only on the file name: the output on btmp files will show that every entry is a failed login.

METHODS

  "new"
Module constructor.

Returns:

An instance of the class.

  "get_version"
A simple subroutine that returns the version number of the input module.

Returns:

A string representing the version number.

  "get_description"
A simple subroutine that returns a string containing a description of the funcionality of the input module. This string is used when a list of all available input modules is printed out.

Returns:

A string containing a description of the input module.

  "get_time"
UPDATE_ME

This is the main "juice" of the input module. It parses the input file and produces a timestamp object that get's returned (or if we said that self->{'multi_line'} = 0 it will return a single hash reference that contains multiple timestamp objects within it.

This subroutine needs to be implemented at all times and this comments need to be updated to reflect the logic of the routine, what it does and how it does it... are there any risks, might there be loss of data, possibly provide some tips on analysis, etc...

  "get_help"
A simple subroutine that returns a string containing the help message for this particular input module.

Returns:

A string containing a help description for this input module.

  "verify"
The module verify subroutine makes these checks to understand if it's the right file: - check if input it's a file (correct) or a directory (wrong) - check name: if the name includes 'wtmp' or 'btmp' in it
  Note that renamed files will be skipped! - check if filesize is a multiple of entry size (384 bytes)
  Note that size-corrupted will be skipped! - check the first 4 bytes if they contain a valid known utmp entry type
  Note that extensions to what is defined in the linux vanilla kernel will
  make files skipped!

Returns:

A reference to a hash that contains two keys/values.

success -> INT, either 0 or 1 (meaning not the correct structure, or the correct one) msg -> A short description why the verification failed (if the value of success is zero that is).