Convert hex string in syslog to ascii in Graylog

Graylog Central (peer support)
1

I have the following message from auditd tty logging forwarded to syslog:

node=testchefnode05.drf.corp type=TTY msg=audit(1507750553.739:348): tty pid=2203 uid=0 auid=1270 ses=2 major=136 minor=0 comm=“bash” data=63616C20323031310D

The “data” field is a hex string of the recorded tty ketstrokes.

For example the hex string “63616C20323031310D” above would be “cal 2011[13]” in ascii, where [13] is a carriage return.

I would like to get that converted to an ascii string so it is readable. Is there some sort of function that I can use in an extractor or pipeline to do that?

2

There’s no such function out of the box, but you could write a Graylog plugin which will provide this function.

See https://www.graylog.org/blog/71-writing-your-own-graylog-processing-pipeline-functions for an example.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.