Log2t::input::mcafeefireup(3)

NAME
structure - An example input module for log2timeline

METHODS

new A default constructor for the input module. There are no parameters passed to the constructor, however it defines the behaviour of the module. That is to say it indicates whether or not this module parses a file or a directory, and it also defines if this is a log file that gets parsed line-by-line or a file that parses all the timestamp objects and returns them all at once.

init
    A small routine that takes no parameters and is called by the engine before a file is parsed. This routine takes care of initializing global variables, so that no values are stored from a previous file that got parsed by the module to avoid confusion.

end Similar to the init routine, except this routine is called by the engine when the parsing is completed. The purpose of this routine is to close all database handles or other handles that got opened by the module itself (excluding the file handle) and to remove any temporary files that might still be present.

get_time
    This is the main routine of the module. This is the routine that parses the actual file and produces timestamp objects that get returned to the main engine for further processing. The routine reads the file or directory and extracts timestamps and other needed information to create a timestamp object that then gets returned to the engine, either line-by-line or all in one (as defined in the constructor of the module).

verify
    The purpose of this routine is to verify the structure of the file or directory being passed to the module and tell the engine whether not this module is capable of parsing the file in question or not. This routine is therfore very important for the recursive search of the engine, and it is very important to make this routine as compact and optimized as possible to avoid slowing the tool down too much.

get_help()
    Returns a string that contains a longer version of the description of the output module, as well as possibly providing some assistance in how the module should be used.

get_version()
    Returns the version number of the module.

get_description()
    Returns a string that contains a short description of the module. This short description is used when a list of all available modules is printed out.