ELF >
@ ; @ 8 @ # # H- H- H- `- `- `- 8 8 8 $ $ x# x# x# Std x# x# x# Ptd Qtd Rtd H- H- H- GNU sHK=$. @ BE|qX Ys h U a m y , F " 3 3 3 0 s __gmon_start__ _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize r_dbgprintf strcmp free strncasecmp memmove Debug strlen calloc malloc nvlstGetParams cnfparamvalsDestruct es_str2cstr cnfparamsPrint modInit __stack_chk_fail libc.so.6 _edata __bss_start _end pmsnare.so GLIBC_2.4 GLIBC_2.2.5 ii
! ui + H- P- @ X- X- 3 3 3 X 3 3 3 0 / / /
/ / h/ p/ x/ / / / / / / /
/ / / / HH& HtH 5R& %S& h h h h h h h h q h a h Q h
A h 1 h ! h
%m% D %e% D %]% D %U% D %M% D %E% D %=% D %5% D %-% D %%% D % % D %% D %
% D %% D H= ) H) H9tH$ Ht H=( H5( H)HHH?HHtH$ Htf D =( u+UH=$ Ht H=! Ydm( ] w 1 1 H H1ff. @ H H1ff. @ %-ff. 1f HH
$ 1H5 H= & H
4$ 1H5 H=w & H
# 1H5r H=Z & 1Hf. HH1ff. @ H H ATH UHSH HH HH tX H=
H u~HwHE HH u-HHE 1H[]A\ HHE H=
HL%
u_HHE fL%g
HL H=I
H HHE > HL t* H=
H u0HHE HiHE HYHE H=
H H= H H-HE @
H=v H t. H=i H u H= H uLH HE f D H=8 H uFH HE f D ù H= H u:H HE H= H u:H HE H=y H u:H% HE 9 H=W H u:HHE 0 H=- H udHHE H=M H uHHE H} 1H5 H=V
~HH5
HT$HT$3H\HE ` SHH1H5 H= HtH1[ff. @ ATIUH-" SH} Ht D H_ HHuHMtL[1]A\ AW1AVIH5< AUIH=c ATUSHIc^LAn\1H5J H=> )I^pHى[ f< t< tAU9t HuEeM}D9~IcLH IcVLAF\INp)LLuc IS A9 uXIi1LIAH5, DH=
R
H5I HP H5; H H[]A\A]A^A_H5
H=% MAU1IH5
H= AL+Mce
H5 IL H5 LtxH5
H= AUHI+FpDd IcEH{)H4HcH=D+ AEA)F\A)F`A)r @ E1LD1H5
H=F nf H5Y H=% 1Kf D H5)
H= -IM+NpEa
EAn\IcI^p IcEH{D))H4LcLBD# AEA)F\A)F`H UIcNLINp1H5 H= 1H5 H=j IM+NpEa `H5 H=G oAUHI+FpDd
ff. AT1H5 H= US#H HH L% S C E \t E f. HHLH= C1H[ H ;u {u C{u C{ u C Hkt SeE E u D E #011E C CYf [1]A\f UH SH HAHtH(H1H[]H ff. @ AWAVAUIATUHSHH (
IHZ H@ Hj H HPH Lb L`HAD$ I$AD$H 1H5 HIH f= L1L= L
L& @ HE A$c HH9~U} tHع( LHHA HH t! HL uBHE AD$ H5 L!Me 1H[]A\A]A^A_f. % HL u2HE AD$D @ H5 H= 1gf D $ HH=Q ufH} 1L
L AD$ &H HtsH H@ L L`+ H5 H=M 1sL L
m xH5P H=% 1KLH= Hu"LH5 1]H5 1f D 1f 1f AUH= IATIUHSHdH%( HD$1HщÅ M M H$H H=h ЉÅ AE H5= H=l ՉÅu~H
7 1H5 H= ) Åu[H
1H5 H= Åu8H
1H5 H= ÅuH uHz fHiI$HL$dH3 %( uAH[]A\A] ۸D @ H H5" 1H=< d} HH rsyslog.snare pmsnare glbl pmsnare.c parser datetime modExit modGetID getType getKeepType beginCnfLoad endCnfLoad checkCnf activateCnf freeCnf getModCnfName setModCnf parse2 GetParserName newParserInst freeParserInst isCompatibleWithFeature MSWinEventLog LinuxKAudit pmsnare: Begin endCnfLoad
newParserInst (pmsnare)
pmsnare: parser param blk:
objGetObjInterface regCfSysLineHdlr 8.2102.0-15.el8_10.1 entry point '%s' not present in module
pmsnare: free parser instance %p
Message will now be parsed by fix Snare parser.
pmsnare: msg to look at: [%d]'%s'
pmsnare: Message is too short to be Snare!
pmsnare: tab separated message
pmsnare: tab [%d]'%s' msg at the first separator: [%d]'%s'
Found a non-syslog Windows Snare message.
Found a non-syslog Linux Snare message.
Found a syslog Windows Snare message.
pmsnare: Found a syslog Linux Snare message.
pmsnare: new message: [%d]'%s'
pmsnare: tab [%d]'%s' msg after the timestamp and hostname: [%d]'%s'
pmsnare: Snare parser will treat '%s' as tab.
parser.escapecontrolcharactersonreceive parser.escapecontrolcharactertab parser.escapecontrolcharacterscstyle parser.controlcharacterescapeprefix pmsnare: program error, non-handled param '%s'
snare parser init called, compiled with version %s
; 0 D X (l 8 h8 H (( 8< HP zR x $ H FJ w ?:*3$" D \
p
f H] @
XID K0d
AABH F0 D 1 Ek ( ` M FDH uCB H (d FDL L(A0A8D@
8F0A(B BBBA ( L FQA CB ( @A EIL V
AAA H 0 d FBB E(A0D8D@Q
8C0A(B BBBK | 8 s FLD D(D@
(A ABBI GNU @ X-
H- P- o `
7 P/ P X 8 o o ( o o o `- 0 @ P ` p 3 X
0 GA$3a1 GA$3p1113 GA* GA$annobin gcc 8.5.0 20210514 GA$plugin name: gcc-annobin GA$running gcc 8.5.0 20210514 GA* GA* GA!
GA*FORTIFY GA+GLIBCXX_ASSERTIONS GA*GOW * GA*cf_protection GA+omit_frame_pointer GA+stack_clash GA!stack_realign
GA*FORTIFY GA+GLIBCXX_ASSERTIONS pmsnare.so-8.2102.0-15.el8_10.1.x86_64.debug 7zXZ ִF ! t/o] ?Eh=ڊ2N`]. +jfyFV40~
mm uƀ nze z Aj-1S6j]̣AXv*ޏJgەmQ}Km0OX`TGW #m\lV[W,k-Z.p3 S2FCJ|\a \x~`o-"_]F[JnW{Enj?&
b7$ƘS 6tHnx`1;5ĉ3%d+>|["qt&D!z/xюGF;ڗaVOrb%SXvjMW(vVmٽ g &\|< zv g YZ .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .note.gnu.property .init_array .fini_array .data.rel.ro .dynamic .got .data .bss .gnu.build.attributes .gnu_debuglink .gnu_debugdata 8 8 $ o ` ` 4 ( ( 0 7 8 o . E o ( ( 0 T X X 8 ^ B P h c n w
}
2 0 x# x# H- H- P- P- X- X- `- `- P/ P/ 0 0 3 3 3` 3 H
(6 4 \6 ( : (