go-bsm

This is a parser for the FreeBSD audit file format (based on Sun's Basic Security Module (BSM) file format). It can be installed by running go install github.com/tpltnt/go-bsm.

caveat

This tool uses a dirty handwritten parser for binary files. This was done because yacc wasn't available as a tool for Go (as of beginning of 2018) and ANTLv4 requires Java.

TODO

• parse all tokens
• rewrite using parser combinators

references

• audit.log(5)
• FreeBSD handbook Chapter 16: Security Event Auditing
• TrustedBSD OpenBSM - github repository
• Forensics Wiki: Basic Security Module (BSM) file format
• SunSHIELD Basic Security Module Guide (pdf)