Package modules :: Package processing :: Package platform :: Module linux :: Class LinuxSystemTap
[hide private]
[frames] | no frames]

Class LinuxSystemTap

source code

                                 object --+    
                                          |    
lib.cuckoo.common.abstracts.BehaviorHandler --+
                                              |
                                             LinuxSystemTap

Parses systemtap generated plaintext logs (see data/strace.stp).

Instance Methods [hide private]
 
__init__(self, *args, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
_check_for_probelkm(self) source code
 
handles_path(self, path)
Needs to return True for the log files this handler wants to process.
source code
 
parse(self, path)
Called after handles_path succeeded, should generate behavior events.
source code
 
run(self)
Return the handler specific structure, gets placed into behavior[self.key].
source code

Inherited from lib.cuckoo.common.abstracts.BehaviorHandler: handle_event

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  key = "processes"

Inherited from lib.cuckoo.common.abstracts.BehaviorHandler: event_types

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, *args, **kwargs)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)

handles_path(self, path)

source code 

Needs to return True for the log files this handler wants to process.

Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.handles_path
(inherited documentation)

parse(self, path)

source code 

Called after handles_path succeeded, should generate behavior events.

Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.parse
(inherited documentation)

run(self)

source code 

Return the handler specific structure, gets placed into behavior[self.key].

Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.run
(inherited documentation)