view misc/lnav/prosody.json @ 5748:dfbced5e54b9

mod_audit_auth: Ignore FAST authentication events by default FAST is more like a cookie that allows linking new connections to a previous (e.g. password) authentication. Since we assume that FAST tokens are secure (not user generated) and not shareable, it reduces a lot of noise by filtering out uninteresting authentication events.
author Matthew Wild <mwild1@gmail.com>
date Fri, 01 Dec 2023 11:34:52 +0000
parents 1be6e375a7c2
children
line wrap: on
line source

{
   "$schema" : "https://lnav.org/schemas/format-v1.schema.json",
   "prosody_log" : {
      "body-field" : "message",
      "description" : "The Prosody IM server log format",
      "level" : {
         "debug" : "^debug$",
         "error" : "^error$",
         "info" : "^info$",
         "warning" : "^warn$"
      },
      "level-field" : "loglevel",
      "multiline" : false,
      "ordered-by-time" : true,
      "regex" : {
         "standard" : {
            "pattern" : "^(?<timestamp>\\w{3} \\d{2} \\d{2}:\\d{2}:\\d{2}\\s+)(?<loggername>\\S+)\\s+(?<loglevel>debug|info|warn|error)\\s+(?<message>.+)$"
         }
      },
      "sample" : [
         {
            "line" : "Jan 31 11:07:34 c2s565063fff480\tinfo\tClient connected"
         }
      ],
      "timestamp-field" : "timestamp",
      "timestamp-format" : [
         "%b %d %H:%M:%S "
      ],
      "title" : "Prosody log",
      "url" : "https://prosody.im/doc/logging",
      "value" : {
         "loggername" : {
            "identifier" : true,
            "kind" : "string"
         },
         "payload" : {
            "kind" : "xml"
         }
      }
   }
}