Skip to content

Commit e4d9e33

Browse files
stacknilstacknil
committed
test: lock down golden report contracts with regression fixtures
1 parent 1183b54 commit e4d9e33

9 files changed

Lines changed: 539 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ out/
44
report.md
55
report.json
66
*.exe
7+
!tests/fixtures/report_contracts/**/report.md
8+
!tests/fixtures/report_contracts/**/report.json

‎CMakeLists.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,12 @@ if(BUILD_TESTING)
4242
${CMAKE_CURRENT_SOURCE_DIR}/assets/sample_config.json
4343
${CMAKE_CURRENT_BINARY_DIR}/cli_test_output
4444
)
45+
46+
add_executable(test_report_contracts tests/test_report_contracts.cpp)
47+
add_test(
48+
NAME report_contracts
49+
COMMAND test_report_contracts
50+
$<TARGET_FILE:loglens>
51+
${CMAKE_CURRENT_BINARY_DIR}/report_contract_output
52+
)
4553
endif()

‎tests/fixtures/report_contracts/journalctl_short_full/input.log‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Tue 2026-03-10 08:11:22 UTC example-host sshd[2234]: Failed password for invalid user admin from 203.0.113.10 port 51022 ssh2
2+
Tue 2026-03-10 08:12:05 UTC example-host sshd[2235]: Failed password for root from 203.0.113.10 port 51030 ssh2
3+
Tue 2026-03-10 08:13:10 UTC example-host sshd[2236]: Failed password for test from 203.0.113.10 port 51040 ssh
4+
Tue 2026-03-10 08:14:44 UTC example-host sshd[2237]: Failed password for guest from 203.0.113.10 port 51050 ssh2
5+
Tue 2026-03-10 08:18:05 UTC example-host sshd[2238]: Failed publickey for invalid user deploy from 203.0.113.10 port 51060 ssh2
6+
Tue 2026-03-10 08:20:10 UTC example-host sshd[2240]: Accepted password for alice from 203.0.113.20 port 51111 ssh2
7+
Tue 2026-03-10 08:21:00 UTC example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart ssh
8+
Tue 2026-03-10 08:22:10 UTC example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/journalctl -xe
9+
Tue 2026-03-10 08:24:15 UTC example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/vi /etc/ssh/sshd_config
10+
Tue 2026-03-10 08:25:30 UTC example-host sshd[2241]: Failed password for bob from 203.0.113.30 port 51234 ssh2
11+
Tue 2026-03-10 08:26:02 UTC example-host sshd[2242]: Invalid user backup from 203.0.113.31 port 51236
12+
Tue 2026-03-10 08:28:33 UTC example-host pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.41 user=alice
13+
Tue 2026-03-10 08:29:50 UTC example-host pam_unix(sudo:session): session opened for user root by alice(uid=0)
14+
Tue 2026-03-10 08:30:12 UTC example-host sshd[2244]: Failed password for invalid user qauser from 203.0.113.50 port 51290 ssh2
15+
Tue 2026-03-10 08:31:18 UTC example-host sshd[2245]: Connection closed by authenticating user alice 203.0.113.51 port 51291 [preauth]
16+
Tue 2026-03-10 08:32:26 UTC example-host sshd[2246]: Timeout, client not responding from 203.0.113.52 port 51292

‎tests/fixtures/report_contracts/journalctl_short_full/report.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"tool": "LogLens",
3+
"input": "tests/fixtures/report_contracts/journalctl_short_full/input.log",
4+
"input_mode": "journalctl_short_full",
5+
"timezone_present": true,
6+
"parser_quality": {
7+
"total_lines": 16,
8+
"parsed_lines": 14,
9+
"unparsed_lines": 2,
10+
"parse_success_rate": 0.8750,
11+
"top_unknown_patterns": [
12+
{"pattern": "sshd_connection_closed_preauth", "count": 1},
13+
{"pattern": "sshd_timeout_or_disconnection", "count": 1}
14+
]
15+
},
16+
"parsed_event_count": 14,
17+
"warning_count": 2,
18+
"finding_count": 3,
19+
"event_counts": [
20+
{"event_type": "ssh_failed_password", "count": 4},
21+
{"event_type": "ssh_accepted_password", "count": 1},
22+
{"event_type": "ssh_invalid_user", "count": 3},
23+
{"event_type": "ssh_failed_publickey", "count": 1},
24+
{"event_type": "pam_auth_failure", "count": 1},
25+
{"event_type": "session_opened", "count": 1},
26+
{"event_type": "sudo_command", "count": 3}
27+
],
28+
"findings": [
29+
{
30+
"rule": "brute_force",
31+
"subject_kind": "source_ip",
32+
"subject": "203.0.113.10",
33+
"event_count": 5,
34+
"window_start": "2026-03-10 08:11:22",
35+
"window_end": "2026-03-10 08:18:05",
36+
"usernames": [],
37+
"summary": "5 failed SSH attempts from 203.0.113.10 within 10 minutes."
38+
},
39+
{
40+
"rule": "multi_user_probing",
41+
"subject_kind": "source_ip",
42+
"subject": "203.0.113.10",
43+
"event_count": 5,
44+
"window_start": "2026-03-10 08:11:22",
45+
"window_end": "2026-03-10 08:18:05",
46+
"usernames": ["admin", "deploy", "guest", "root", "test"],
47+
"summary": "203.0.113.10 targeted 5 usernames within 15 minutes."
48+
},
49+
{
50+
"rule": "sudo_burst",
51+
"subject_kind": "username",
52+
"subject": "alice",
53+
"event_count": 3,
54+
"window_start": "2026-03-10 08:21:00",
55+
"window_end": "2026-03-10 08:24:15",
56+
"usernames": [],
57+
"summary": "alice ran 3 sudo commands within 5 minutes."
58+
}
59+
],
60+
"warnings": [
61+
{"line_number": 15, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
62+
{"line_number": 16, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
63+
]
64+
}

‎tests/fixtures/report_contracts/journalctl_short_full/report.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# LogLens Report
2+
3+
## Summary
4+
5+
- Input: `tests/fixtures/report_contracts/journalctl_short_full/input.log`
6+
- Input mode: journalctl_short_full
7+
- Timezone present: true
8+
- Total lines: 16
9+
- Parsed lines: 14
10+
- Unparsed lines: 2
11+
- Parse success rate: 87.50%
12+
- Parsed events: 14
13+
- Findings: 3
14+
- Parser warnings: 2
15+
16+
## Findings
17+
18+
| Rule | Subject | Count | Window | Notes |
19+
| --- | --- | ---: | --- | --- |
20+
| brute_force | 203.0.113.10 | 5 | 2026-03-10 08:11:22 -> 2026-03-10 08:18:05 | 5 failed SSH attempts from 203.0.113.10 within 10 minutes. |
21+
| multi_user_probing | 203.0.113.10 | 5 | 2026-03-10 08:11:22 -> 2026-03-10 08:18:05 | 203.0.113.10 targeted 5 usernames within 15 minutes. Usernames: admin, deploy, guest, root, test |
22+
| sudo_burst | alice | 3 | 2026-03-10 08:21:00 -> 2026-03-10 08:24:15 | alice ran 3 sudo commands within 5 minutes. |
23+
24+
## Event Counts
25+
26+
| Event Type | Count |
27+
| --- | ---: |
28+
| ssh_failed_password | 4 |
29+
| ssh_accepted_password | 1 |
30+
| ssh_invalid_user | 3 |
31+
| ssh_failed_publickey | 1 |
32+
| pam_auth_failure | 1 |
33+
| session_opened | 1 |
34+
| sudo_command | 3 |
35+
36+
## Parser Quality
37+
38+
| Unknown Pattern | Count |
39+
| --- | ---: |
40+
| sshd_connection_closed_preauth | 1 |
41+
| sshd_timeout_or_disconnection | 1 |
42+
43+
## Parser Warnings
44+
45+
| Line | Reason |
46+
| ---: | --- |
47+
| 15 | unrecognized auth pattern: sshd_connection_closed_preauth |
48+
| 16 | unrecognized auth pattern: sshd_timeout_or_disconnection |

‎tests/fixtures/report_contracts/syslog_legacy/input.log‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Mar 10 08:11:22 example-host sshd[1234]: Failed password for invalid user admin from 203.0.113.10 port 51022 ssh2
2+
Mar 10 08:12:05 example-host sshd[1235]: Failed password for root from 203.0.113.10 port 51030 ssh2
3+
Mar 10 08:13:10 example-host sshd[1236]: Failed password for test from 203.0.113.10 port 51040 ssh2
4+
Mar 10 08:14:44 example-host sshd[1237]: Failed password for guest from 203.0.113.10 port 51050 ssh2
5+
Mar 10 08:18:05 example-host sshd[1238]: Failed password for invalid user deploy from 203.0.113.10 port 51060 ssh2
6+
Mar 10 08:20:10 example-host sshd[1240]: Accepted password for alice from 203.0.113.20 port 51111 ssh2
7+
Mar 10 08:21:00 example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart ssh
8+
Mar 10 08:22:10 example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/journalctl -xe
9+
Mar 10 08:24:15 example-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/vi /etc/ssh/sshd_config
10+
Mar 10 08:25:30 example-host sshd[1241]: Failed password for bob from 203.0.113.30 port 51234 ssh2
11+
Mar 10 08:26:02 example-host sshd[1242]: Invalid user backup from 203.0.113.31 port 51236
12+
Mar 10 08:27:10 example-host sshd[1243]: Failed publickey for invalid user svc-backup from 203.0.113.40 port 51240 ssh2
13+
Mar 10 08:28:33 example-host pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.41 user=alice
14+
Mar 10 08:29:50 example-host pam_unix(sudo:session): session opened for user root by alice(uid=0)
15+
Mar 10 08:30:12 example-host sshd[1244]: Connection closed by authenticating user alice 203.0.113.50 port 51290 [preauth]
16+
Mar 10 08:31:18 example-host sshd[1245]: Timeout, client not responding from 203.0.113.51 port 51291

‎tests/fixtures/report_contracts/syslog_legacy/report.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"tool": "LogLens",
3+
"input": "tests/fixtures/report_contracts/syslog_legacy/input.log",
4+
"input_mode": "syslog_legacy",
5+
"assume_year": 2026,
6+
"timezone_present": false,
7+
"parser_quality": {
8+
"total_lines": 16,
9+
"parsed_lines": 14,
10+
"unparsed_lines": 2,
11+
"parse_success_rate": 0.8750,
12+
"top_unknown_patterns": [
13+
{"pattern": "sshd_connection_closed_preauth", "count": 1},
14+
{"pattern": "sshd_timeout_or_disconnection", "count": 1}
15+
]
16+
},
17+
"parsed_event_count": 14,
18+
"warning_count": 2,
19+
"finding_count": 3,
20+
"event_counts": [
21+
{"event_type": "ssh_failed_password", "count": 4},
22+
{"event_type": "ssh_accepted_password", "count": 1},
23+
{"event_type": "ssh_invalid_user", "count": 3},
24+
{"event_type": "ssh_failed_publickey", "count": 1},
25+
{"event_type": "pam_auth_failure", "count": 1},
26+
{"event_type": "session_opened", "count": 1},
27+
{"event_type": "sudo_command", "count": 3}
28+
],
29+
"findings": [
30+
{
31+
"rule": "brute_force",
32+
"subject_kind": "source_ip",
33+
"subject": "203.0.113.10",
34+
"event_count": 5,
35+
"window_start": "2026-03-10 08:11:22",
36+
"window_end": "2026-03-10 08:18:05",
37+
"usernames": [],
38+
"summary": "5 failed SSH attempts from 203.0.113.10 within 10 minutes."
39+
},
40+
{
41+
"rule": "multi_user_probing",
42+
"subject_kind": "source_ip",
43+
"subject": "203.0.113.10",
44+
"event_count": 5,
45+
"window_start": "2026-03-10 08:11:22",
46+
"window_end": "2026-03-10 08:18:05",
47+
"usernames": ["admin", "deploy", "guest", "root", "test"],
48+
"summary": "203.0.113.10 targeted 5 usernames within 15 minutes."
49+
},
50+
{
51+
"rule": "sudo_burst",
52+
"subject_kind": "username",
53+
"subject": "alice",
54+
"event_count": 3,
55+
"window_start": "2026-03-10 08:21:00",
56+
"window_end": "2026-03-10 08:24:15",
57+
"usernames": [],
58+
"summary": "alice ran 3 sudo commands within 5 minutes."
59+
}
60+
],
61+
"warnings": [
62+
{"line_number": 15, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
63+
{"line_number": 16, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
64+
]
65+
}

‎tests/fixtures/report_contracts/syslog_legacy/report.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# LogLens Report
2+
3+
## Summary
4+
5+
- Input: `tests/fixtures/report_contracts/syslog_legacy/input.log`
6+
- Input mode: syslog_legacy
7+
- Assume year: 2026
8+
- Timezone present: false
9+
- Total lines: 16
10+
- Parsed lines: 14
11+
- Unparsed lines: 2
12+
- Parse success rate: 87.50%
13+
- Parsed events: 14
14+
- Findings: 3
15+
- Parser warnings: 2
16+
17+
## Findings
18+
19+
| Rule | Subject | Count | Window | Notes |
20+
| --- | --- | ---: | --- | --- |
21+
| brute_force | 203.0.113.10 | 5 | 2026-03-10 08:11:22 -> 2026-03-10 08:18:05 | 5 failed SSH attempts from 203.0.113.10 within 10 minutes. |
22+
| multi_user_probing | 203.0.113.10 | 5 | 2026-03-10 08:11:22 -> 2026-03-10 08:18:05 | 203.0.113.10 targeted 5 usernames within 15 minutes. Usernames: admin, deploy, guest, root, test |
23+
| sudo_burst | alice | 3 | 2026-03-10 08:21:00 -> 2026-03-10 08:24:15 | alice ran 3 sudo commands within 5 minutes. |
24+
25+
## Event Counts
26+
27+
| Event Type | Count |
28+
| --- | ---: |
29+
| ssh_failed_password | 4 |
30+
| ssh_accepted_password | 1 |
31+
| ssh_invalid_user | 3 |
32+
| ssh_failed_publickey | 1 |
33+
| pam_auth_failure | 1 |
34+
| session_opened | 1 |
35+
| sudo_command | 3 |
36+
37+
## Parser Quality
38+
39+
| Unknown Pattern | Count |
40+
| --- | ---: |
41+
| sshd_connection_closed_preauth | 1 |
42+
| sshd_timeout_or_disconnection | 1 |
43+
44+
## Parser Warnings
45+
46+
| Line | Reason |
47+
| ---: | --- |
48+
| 15 | unrecognized auth pattern: sshd_connection_closed_preauth |
49+
| 16 | unrecognized auth pattern: sshd_timeout_or_disconnection |

0 commit comments

Comments
 (0)