------------------------------------------------------------------------
r2098 | mbr | 2007-07-27 01:01:25 -0400 (Fri, 27 Jul 2007) | 1 line
Changed paths:
   A /psad/branches/psad-2.0.8 (from /psad/trunk:2097)

created psad-2.0.8 branch
------------------------------------------------------------------------
r2097 | mbr | 2007-07-27 00:59:36 -0400 (Fri, 27 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad.8

added --gnuplot command line argument detail
------------------------------------------------------------------------
r2096 | mbr | 2007-07-27 00:30:16 -0400 (Fri, 27 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/ChangeLog

added --gnuplot-template file
------------------------------------------------------------------------
r2095 | mbr | 2007-07-27 00:28:49 -0400 (Fri, 27 Jul 2007) | 5 lines
Changed paths:
   M /psad/trunk/psad

- Added usage() detail for all --gnuplot command line switches.
- Added --gnuplot-template so that an existing template can be used
  for all Gnuplot directive (which are usually contained within a
  ".gnu" file by convention).

------------------------------------------------------------------------
r2094 | mbr | 2007-07-08 19:41:33 -0400 (Sun, 08 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

bugfix for removing gnuplot titles with underscore chars since some fonts used by Gnuplot do not seem to like them
------------------------------------------------------------------------
r2093 | mbr | 2007-07-08 13:45:54 -0400 (Sun, 08 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

relaxed permissions on store file, minor --use-store processing bugfix
------------------------------------------------------------------------
r2092 | mbr | 2007-07-08 08:17:24 -0400 (Sun, 08 Jul 2007) | 13 lines
Changed paths:
   M /psad/trunk/ChangeLog
   A /psad/trunk/Storable
   A /psad/trunk/Storable/ChangeLog
   A /psad/trunk/Storable/MANIFEST
   A /psad/trunk/Storable/Makefile.PL
   A /psad/trunk/Storable/README
   A /psad/trunk/Storable/Storable.pm
   A /psad/trunk/Storable/Storable.xs
   A /psad/trunk/Storable/VERSION
   A /psad/trunk/Storable/hints
   A /psad/trunk/Storable/hints/gnukfreebsd.pl
   A /psad/trunk/Storable/hints/gnuknetbsd.pl
   A /psad/trunk/Storable/hints/linux.pl
   A /psad/trunk/Storable/ppport.h
   A /psad/trunk/Storable/t
   A /psad/trunk/Storable/t/HAS_ATTACH.pm
   A /psad/trunk/Storable/t/HAS_HOOK.pm
   A /psad/trunk/Storable/t/HAS_OVERLOAD.pm
   A /psad/trunk/Storable/t/Test
   A /psad/trunk/Storable/t/Test/Builder.pm
   A /psad/trunk/Storable/t/Test/More.pm
   A /psad/trunk/Storable/t/Test/Simple.pm
   A /psad/trunk/Storable/t/attach_errors.t
   A /psad/trunk/Storable/t/attach_singleton.t
   A /psad/trunk/Storable/t/blessed.t
   A /psad/trunk/Storable/t/canonical.t
   A /psad/trunk/Storable/t/circular_hook.t
   A /psad/trunk/Storable/t/code.t
   A /psad/trunk/Storable/t/compat01.t
   A /psad/trunk/Storable/t/compat06.t
   A /psad/trunk/Storable/t/croak.t
   A /psad/trunk/Storable/t/dclone.t
   A /psad/trunk/Storable/t/downgrade.t
   A /psad/trunk/Storable/t/file_magic.t
   A /psad/trunk/Storable/t/forgive.t
   A /psad/trunk/Storable/t/freeze.t
   A /psad/trunk/Storable/t/integer.t
   A /psad/trunk/Storable/t/interwork56.t
   A /psad/trunk/Storable/t/just_plain_nasty.t
   A /psad/trunk/Storable/t/lock.t
   A /psad/trunk/Storable/t/make_56_interwork.pl
   A /psad/trunk/Storable/t/make_downgrade.pl
   A /psad/trunk/Storable/t/malice.t
   A /psad/trunk/Storable/t/overload.t
   A /psad/trunk/Storable/t/recurse.t
   A /psad/trunk/Storable/t/restrict.t
   A /psad/trunk/Storable/t/retrieve.t
   A /psad/trunk/Storable/t/sig_die.t
   A /psad/trunk/Storable/t/st-dump.pl
   A /psad/trunk/Storable/t/store.t
   A /psad/trunk/Storable/t/testlib.pl
   A /psad/trunk/Storable/t/threads.t
   A /psad/trunk/Storable/t/tied.t
   A /psad/trunk/Storable/t/tied_hook.t
   A /psad/trunk/Storable/t/tied_items.t
   A /psad/trunk/Storable/t/utf8.t
   A /psad/trunk/Storable/t/utf8hash.t
   A /psad/trunk/Storable/t/weak.t
   M /psad/trunk/install.pl
   M /psad/trunk/psad

 - In --gnuplot mode, added the ability to specify the view coordinates
   for 3D graph viewing with --gnuplot-view.
 - Added the Storable-2.16 module along with the --use-store-file argument
   so that in --gnuplot mode the Gnuplot data can be stored on disk and
   retrieve quickly.  This eliminates a large performance bottleneck when
   Gnuplot configuration directives are tweaked while the same graph is
   generated multiple times.
 - Added --gnuplot-grayscale to generate graphs without the default red
   color for graph points.
 - Bugfix for regular expressions not being imported correctly from within
   the --CSV-fields argument.


------------------------------------------------------------------------
r2091 | mbr | 2007-07-07 13:31:34 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

bugfix for adding quotes to gnuplot axis ranges
------------------------------------------------------------------------
r2090 | mbr | 2007-07-07 09:55:50 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/VERSION
   M /psad/trunk/psad

updated version and ChangeLog for 2.0.8
------------------------------------------------------------------------
r2089 | mbr | 2007-07-07 09:49:44 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

added neg-regex to gnuplot title
------------------------------------------------------------------------
r2088 | mbr | 2007-07-07 09:16:04 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

updated gnuplot_time_to_interval() to return the current time interval - this greatly speeds up the --gnuplot mode when time counts are used
------------------------------------------------------------------------
r2087 | mbr | 2007-07-07 00:44:07 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

bugfix to assign time interval increment in 'counthouruniq', 'countminuniq', and 'countdayuniq' modes
------------------------------------------------------------------------
r2086 | mbr | 2007-07-07 00:10:54 -0400 (Sat, 07 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

major restructuring for --gnuplot mode, time-based counts are better supported now
------------------------------------------------------------------------
r2085 | mbr | 2007-07-03 22:04:18 -0400 (Tue, 03 Jul 2007) | 3 lines
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/psad

In --gnuplot mode, added the ability to summarize iptables log fields over
various time scales (minutes, hours, and days).

------------------------------------------------------------------------
r2084 | mbr | 2007-07-01 16:37:20 -0400 (Sun, 01 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

added the ability to graph uniq port counts in --gnuplot mode
------------------------------------------------------------------------
r2083 | mbr | 2007-07-01 16:16:29 -0400 (Sun, 01 Jul 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

bugfix to ensure iptables match criteria are enforced
------------------------------------------------------------------------
r2082 | mbr | 2007-07-01 15:43:47 -0400 (Sun, 01 Jul 2007) | 8 lines
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/psad

- Added --analysis-fields so the iptables log messages that are parsed in
  -A mode can be restricted to those that meet certain criteria. For
  example, to restrict the analyze mode to process packets with a source
  address of 192.168.10.1, use this command:

        psad -A --analysis-fields "src:192.168.10.1"


------------------------------------------------------------------------
r2081 | mbr | 2007-07-01 14:58:22 -0400 (Sun, 01 Jul 2007) | 6 lines
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/psad

- In --gnuplot mode, added the ability to generate the count for a CSV
  field instead of the field itself. Supported modes are an absolute
  count, a relative count vs. another field, and a unique count. This is
  useful to plot graphs of source IP vs. the number unique ports for
  example.

------------------------------------------------------------------------
r2080 | mbr | 2007-06-30 15:56:50 -0400 (Sat, 30 Jun 2007) | 14 lines
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/psad

- Added --gnuplot mode so that psad can output data that is suitable for
  plotting with gnuplot. All output produced in this mode is integer data
  with the exception of date stamps that are derived from iptables syslog
  messages.
- Added the ability to negate match conditions on fields specified with
  the --CSV-fields argument by prepending the string "not" (which plays
  more nicely with shells like bash than a character like "!"). For
  example, to graph all packet data in --gnuplot or --CSV modes that
  originates from the 11.11.0.0/16 subnet and is not destined for port 
  80, the following argument does the trick:

        --CSV-fields "src:11.11.0.0/255.255.0.0 dp:not80"


------------------------------------------------------------------------
r2079 | mbr | 2007-06-29 22:51:42 -0400 (Fri, 29 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/psad

started on --gnuplot mode for creating parsed iptables data suitable for visualization with gnuplot
------------------------------------------------------------------------
r2077 | mbr | 2007-06-28 23:17:19 -0400 (Thu, 28 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/psad
   M /psad/trunk/psad.conf

added validation for the SYSLOG_FACILITY and SYSLOG_PRIORITY vars
------------------------------------------------------------------------
r2076 | mbr | 2007-06-28 22:57:00 -0400 (Thu, 28 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/CREDITS

update for pyllyukko
------------------------------------------------------------------------
r2075 | mbr | 2007-06-28 22:47:04 -0400 (Thu, 28 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/VERSION
   M /psad/trunk/psad

2.0.8-pre1
------------------------------------------------------------------------
r2074 | mbr | 2007-06-28 22:46:17 -0400 (Thu, 28 Jun 2007) | 3 lines
Changed paths:
   M /psad/trunk/ChangeLog
   M /psad/trunk/psad
   M /psad/trunk/psad.conf

Added the ability to configure the syslog facility and priority via the
psad.conf file (see the SYSLOG_FACILITY and SYSLOG_PRIORITY variables).

------------------------------------------------------------------------
r2073 | mbr | 2007-06-28 21:10:47 -0400 (Thu, 28 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/packaging/psad.spec

updated to respect the %_initrddir RPM macro
------------------------------------------------------------------------
r2072 | mbr | 2007-06-28 20:49:18 -0400 (Thu, 28 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/packaging/cd_rpmbuilder

updated to remove md5 sum files
------------------------------------------------------------------------
r2071 | mbr | 2007-06-16 21:08:35 -0400 (Sat, 16 Jun 2007) | 1 line
Changed paths:
   M /psad/trunk/signatures

minor msg field typo fix for the 'MISC Microsoft PPTP communication attempt'
------------------------------------------------------------------------
