ELF > @ ( @ 8 @ d d x x x $ $ Ptd \ \ Qtd Rtd x x x GNU \
d;jAl @
BE|qX XsԹ u a 8 R " # # #
~ x ` __gmon_start__ _init _fini _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize _Jv_RegisterClasses dbgprintf Debug strncasecmp memmove modInit __stack_chk_fail libc.so.6 _edata __bss_start _end pmsnare.so GLIBC_2.2.5 GLIBC_2.4 ui ii
x
HH] Ht3 H 5 % @ % h % h % h % h % h % h Hp H=b UH)HHw]H Ht] @ H9 H=2 UH)HHHH?HHu]H Ht]H @ = u'H=g UHt H= ]h] @ f. H= t&H HtUH= H]W Kf. 1 1 HI H1 %-HH
1H5* H=* H
1H5 H=
H
1H5 H= u H
^ 1H5 H= X 1HÐHyH1 HH HH H= H Ht&H= Hu#HH1f D HH1 H=v Ht%H=k Hu"HHf D HH1 H=B Ht%H=5 Hu:HsHj Hq HXf f. H= HuH6H H=W HH1H D f. AW1AVAUATIH=D USHIl$JA\$TH=_ Il$h)1Hi E < < <# HuHY H=5 I1ɾ 1 ID$JA\$TID$h)ӃL@t!x u A8 IuH H= 1ɾ 11H tIT$JH= IT$h1H[]A\A]A^A_ H H=z 1Iپ a<} t H5p H.H= 1Lm$H5G
L H59 LMII
D$ d$ D$
DsHMLE IcHHD+t$ D
J,8D Al$TAl$XHMHuE A^HLcLBD-
BD( H= Al$TAl$X1Sf D MhH_ H=K 1M "
H5<
LH56 L
uu I)IMIuHcAE HHAD-
D( H=^ Al$TAl$X1f D H= 1z D Hc D H5 L:A D$ \ gH5W L%F D AUH=; ATIUHSHHdH%( HD$1Hхu
Hu#HL$dH3 %( ( H[]A\A] @ MtH$HtH= ҅AtHkHE DfA$ H5 H= ӅAu1H
h H5 H= \ Au1H
$ H5 H= 8 Au1H
H5 H= A_1H
H5 H=o A7H 8 tH5 H= 1Z 4 R HH rsyslog.snare errmsg pmsnare.c glbl parser datetime modExit modGetID getType getKeepType parse GetParserName isCompatibleWithFeature msg too short!
#011 MSWinEventLog LinuxKAudit objGetObjInterface regCfSysLineHdlr 8.24.0-57.el7_9.3 entry point '%s' not present in module
Message will now be parsed by fix Snare parser.
pmsnare: msg to look at: [%d]'%s'
pmsnare: separator [%d]'%s' msg after the first separator: [%d]'%s'
pmsnare: tab separated message
found a Snare message with snare not set to send syslog messages
found a Snare message with snare set to send syslog messages
pmsnare: new message: [%d]'%s'
pmsnare: separator [%d]'%s' msg after the timestamp and hostname: [%d]'%s'
snare parser init called, compiled with version %s
;\
x @ P0 P ` zR x $ p FJ w ?;*3$" D \ t
Dz
Q =S L X BDB B(K0A8DP
8F0A(B BBBD < D ~ BID D(G@{
(A ABBE x
` x o 0
o o o o o
pmsnare.so.debug 57zXZ ִF ! t/
?] ?Eh=ڊ2Nў1vg'E߽h)lj#좏P?U+ IosDt1}j<>V# > tOpiM%(. F عP
!\x ShϠ?Z 괘yd;QaNЩkU/Xk8i~˼ҀI}CҏG͐_!.,m*?
CI{+=Sdi>
UKdM_10dQƁ>uVeu1EG@\A!$*5!ܩ
聥ld~"VES &}K$6F*NK6̭'Wg~l틐@ Y4&rj]; [&V^ⴝd *m8/E@m=g$T!Ps @+ ޫ )j:\n-hA?a0-L^ E!.Ϡ8 ڋ&ɿ7 M\N2@ xH
zY:.- GYe։@\otiZ.;3TcY趈BT~\|tJH3DwFc4Y\ &3 yݘA"zSXUv1-hj(Zj]H0Bs^9_bpw(Lɹ5
<}ۣ; n[hKSP D.\n
HL=TZ&&at;ֱOqIMڅ.tހ0 x¤<A2< jR^d HMgg YZ .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .data.rel.ro .dynamic .got .data .bss .gnu_debuglink .gnu_debugdata $ o < ( 0 0 0 8 o " E o 0 T ^ B h x x c p n N t ` ` z 2 p p \ x x x # # # # '