1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
# How to write a syslog plugin
## Locate/create test data
* Add a test file to the test_data directory
## Create empty files and classes
* plugin file in plaso/parsers/syslog_plugins
* Create an empty subclass of [SyslogPlugin](../api/plaso.parsers.syslog_plugins.html#module-plaso.parsers.syslog_plugins.interface)
* Register it with the syslog parser by calling SyslogParser.RegisterPlugin()
* Create an empty subclass of [SyslogLineEventData](../api/plaso.parsers.html#plaso.parsers.syslog.SyslogLineEventData)
* Choose an appropriate DATA_TYPE value, starting with 'syslog:'
* plugin test file in `tests/parsers/syslog_plugins`
* formatter file in `plaso/formatters`
* Create an empty subclass of [ConditionalEventFormatter](../api/plaso.formatters.htm#plaso.formatters.interface.ConditionalEventFormatter)
* Define the DATA_TYPE value to be the same as for your EventData class
* formatter test file in `tests/formatters`
## Write event data class
* Create a subclass of [SyslogLineEventData](../api/plaso.parsers.html#plaso.parsers.syslog.SyslogLineEventData)
in the plugin file.
* Define the attributes events produced by your plugin will have.
## Write minimal tests
* Write a test that loads your plugin and parses a file.
* It will fail initially, but running the test while you're developing your
plugin gives you a quick way to see if your code is doing what you expect.
## Develop plugin
* Implement your subclass of [SyslogPlugin](../api/plaso.parsers.syslog_plugins.html#module-plaso.parsers.syslog_plugins.interface)
* You'll need to define/overwrite:
* NAME
* DESCRIPTION
* REPORTER
* MESSAGE_GRAMMARS
## Write the formatter
* Implement your formatter
## Expand tests
* Add additional tests that test your plugin and formatter
## Register classes
* Edit `plaso/parsers/syslog_plugins/__init__.py` to import your plugin in
alphabetical order.
* Edit `plaso/formatters/__init__.py` to import your formatter in
alphabetical order.
## Code review/submit
|
