Edit: /usr/lib64/rsyslog/pmsnare.so (20536B)
ELF > @ 8I @ 8 @ H H 0 0 0 0= 0M 0M H= HM HM $ $ Std Ptd <5 <5 <5 Qtd Rtd 0= 0M 0M GNU GNU '?U*\C_w!5 Ys U Z m f z s , F "
p __gmon_start__ _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize free r_dbgprintf strcmp Debug malloc nvlstGetParams cnfparamvalsDestruct es_str2cstr cnfparamsPrint calloc strlen strncasecmp memmove modInit loadConf __stack_chk_fail libcap-ng.so.0 libc.so.6 pmsnare.so GLIBC_2.4 GLIBC_2.2.5 ii
! ui + 0M 8M ` @M @M S p2 S 1 S 2 S H2 S S O O O O O O `O hO pO xO O O O
O O
O O O O O HH? HtH 5*? %+? h h h h h h h h q h a h Q h
A h 1 h ! h
%E> D %=> D %5> D %-> D %%> D % > D %> D %
> D %> D %= D %= D %= D %= D %= D H=A HA H9tH= Ht H=A H5A H)HH?HHHtH= Htf D =eA u+UH== Ht H=: Yd=A ] w 1 1 H% H1ff. @ H H1ff. @ 1f %-ff. 1f 1f 1f UH- 1H
= HH5 {= H1H
< H5} b= H1H
F< H5k I= 1] D HH1ff. @ ATL%? UHSI $Ht D HH[ HuLHtH[1]A\ UHH1H5T H= HtH1]ff. @ AWAVAUATUSHH IH H L H1LL= L5L- LL
X HLIDI $vH
L> HLHDI $SHLHHDI $7H5 HIDI $ H5 HH HDI $H5 HHK HDI $H5 HHHDI $H5 HHHDI $LHHHDI $H5 HHHDI $bL HH LHDI $?L8L
HLIDI $ H
uL HLHDI $H2LHHDI $H5
HIDI $H5 HHa HDI $H5 HHHDI $H5 HH HDI $dH5 HHHDI $DLHHHDI $(AŅt1H5 Ht
HH rsyslog.snare pmsnare glbl pmsnare.c parser datetime modExit modGetID getType getKeepType beginCnfLoad endCnfLoad checkCnf activateCnf freeCnf getModCnfName setModCnf parse2 GetParserName newParserInst checkParserInst freeParserInst isCompatibleWithFeature newParserInst (pmsnare)
pmsnare: parser param blk:
pmsnare: Begin endCnfLoad
MSWinEventLog LinuxKAudit objGetObjInterface regCfSysLineHdlr 8.2510.0-2.el9_8.2 pmsnare: free parser instance %p
entry point '%s' not present in module
parser.escapecontrolcharactersonreceive parser.escapecontrolcharactertab parser.escapecontrolcharacterscstyle parser.controlcharacterescapeprefix pmsnare: program error, non-handled param '%s'
pmsnare: Snare parser will treat '%s' as tab.
Message will now be parsed by fix Snare parser.
pmsnare: msg to look at: [%d]'%s'
pmsnare: Message is too short to be Snare!
pmsnare: tab separated message
pmsnare: tab [%d]'%s' msg at the first separator: [%d]'%s'
Found a non-syslog Windows Snare message.
Found a non-syslog Linux Snare message.
Found a syslog Windows Snare message.
pmsnare: Found a syslog Linux Snare message.
pmsnare: new message: [%d]'%s'
pmsnare: tab [%d]'%s' msg after the timestamp and hostname: [%d]'%s'
snare parser init called, compiled with version %s
; t 4 H \ p $ 4 D8 D 8 4 zR x $ FJ w ?:*3$" D \ `
p \
X d p l x t p l[ EU , ( @ M FHD uCB l 1 Ek H X FBB B(A0A8D@
8D0A(B BBBE H FBB B(D0A8DP9
8D0A(B BBBE ( lF EIL ^
DAA 8 L E FKA H(G0(C ABB H M FNE I(D0A8DP
8F0A(B BBBK 8 FLA D(G@
(D ABBI ` @M
! 0M 8M o
7 HO P P o o x o o H o HM 0 @ P ` p
p2
1 2 H2 S pmsnare.so-8.2510.0-2.el9_8.2.x86_64.debug K;7zXZ ִF ! t/] ?Eh=ڊ2N 1nW ,:Hc9]! v"QaDp! .&J H g4j(:>,OLp3,y{;;^1GI~ hzp樔nV' ]6{j&(Ѣ ]ֱ͈ݍ>#1Ĕô0MՐ5 Hς0aБ9U3
/waVGؚ@L g)"Z%C*`;6)9[W>t}_#2yA@p?-mcXb=žx >s=7{/E'XWU -v6+ [5d3,A
UPR9dۀx;t%|6V@iz(4v:FD
/NF5_,Կ& 7=ڕEYֲױ 7)笉8@pVE$4UQ&؇{u/8, 쭱У֑Rc {A҄f|,0o;S|D?dndxhKR jXjSA%t6j
]}c(:kr&ohXQRj )ӳ@}]?V%^ a ]xc iIH`O>Ş#gO\ѝxZ^/e84zf@%W l? ! Ytg YZ .shstrtab .note.gnu.property .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .data.rel.ro .dynamic .got .data .bss .gnu_debuglink .gnu_debugdata $ 1 o $ ; C 7 K o H H * X o x x 0 g P q B P { v ! !
2 0 0 < <5 <5 5 5 0M 0= 8M 8= @M @= HM H= HO H? P @ S C C 0 D H