XH H __text__TEXTp$__data__DATApL __const__TEXT\ __cstring__TEXT \ __picsymbolstub2__TEXT <__la_sym_ptr2__DATA (  __nl_symbol_ptr__DATA, __textcoal_nt__TEXT@  @!p PppvUSDE@D$$E@D$ EU@ ;Bt t E w EED$EU@ ;Bt E@ E w EED$EpD$E@hD$EyD$ E@lD$x D$0 $4 0 $ D[]ÐUSt$\ $ EE@D$HE@,EEx,u EED$DE@EExu EED$@E@LD$?[\]^`{|}~->%d %s %02d %s %s%s%s %s (none) mail ** Alert %d.%ld:%s - %s %d %s %02d %s %s%s%s Rule: %d (level %d) -> '%s' Src IP: %s User: %s %.1256s %.1256s dropalerts%s(1450): Syntax error on regex: '%s': %d.acceptfree a nullDROP%s(1102): Memory error. Exiting.CLOSEDALLOWUNKNOWN%d %s %02d %s %s%s%s %s %s %s:%s->%s:%s ⍀P⍀P⍀P⍀P⍀Pzu⍀Pa\w⍀wPHCb⍀bP/*M⍀MP8⍀8P / H a z $Ë$[O, I=, 3    me [6 KC :2r *  6  r 0 } s6 c[~ RJr B'4  6  r  6 kc ZRr J.& 6 ~ r 77|xtplhd`\XTP7LHD@<840,($  7u @ 6 |k n0 d\k P0 B:@ 06 &1 4 1 4 u 8 8 / 8 & NB8 8      1  8 u < < d ; 0 u ' ' t # # t   t   t   ~t y s r k r et ` Z Y R Y Lt G A @ 9 @ 3t . ( '  ' t      t $  {wz{wzxy}~Pdd<D"D# D.D0$"!H#s 6 L Q * 6 1F ;:$Ix)|$D6D8DPRDR^DSjDUtDVDXD[D]D_$6$5.R;^<=$DdDfDhDlFDnlDr>$dR$DwD|D~DDDD7D^DDDD/DVDDDDD>DqDMD_DfS$wbvl$m & - " %  &0=Tq()? 'N (] 8I Z ldp9+#@ D 0'AeXOw?G8_OS_Store___i686.get_pc_thunk.bx_OS_Log_OS_InitFwLog_FW_Log___local_name_ar_flag_ar_commands_active_responses_currently_rule__eflog__aflog__fflog_Config_FWDROPpm_FWALLOWpm___i686.get_pc_thunk.axdyld_stub_binding_helper_OSMatch_Execute_strlen_strdup_merror_free_ErrorExit_OSMatch_Compile_ftell_fflush_fprintf/mnt/gmirror/ports/security/ossec-hids-server/work/ossec-hids-1.3/src/analysisd/alerts/log.cgcc2_compiled._hostname_mapOS_Store:F(0,1)=(0,1)void:t(0,1)lf:p(0,2)=*(0,3)=(0,4)=xs_Eventinfo:Eventinfo:t(0,3)_Eventinfo:T(0,4)=s128log:(0,5)=*(0,6)=r(0,6);0;127;,0,32;full_log:(0,5),32,32;location:(0,5),64,32;hostname:(0,5),96,32;program_name:(0,5),128,32;srcip:(0,5),160,32;dstip:(0,5),192,32;srcport:(0,5),224,32;dstport:(0,5),256,32;protocol:(0,5),288,32;action:(0,5),320,32;user:(0,5),352,32;dstuser:(0,5),384,32;id:(0,5),416,32;status:(0,5),448,32;command:(0,5),480,32;url:(0,5),512,32;data:(0,5),544,32;systemname:(0,5),576,32;generated_rule:(0,7)=*(0,8)=(0,9)=xs_RuleInfo:,608,32;decoder_info:(0,10)=*(0,11)=(0,12)=s48get_next:(0,13)=(0,14)=@s8;r(0,14);0;255;,0,8;type:(0,13),8,8;use_own_name:(0,13),16,8;id:(0,15)=(0,16)=@s16;r(0,16);0;65535;,32,16;regex_offset:(0,15),48,16;prematch_offset:(0,15),64,16;fts:(0,17)=r(0,17);-2147483648;2147483647;,96,32;parent:(0,5),128,32;name:(0,5),160,32;ftscomment:(0,5),192,32;regex:(0,18)=*(0,19)=(0,20)=xs_OSRegex:,224,32;prematch:(0,18),256,32;program_name:(0,21)=*(0,22)=(0,23)=xs_OSMatch:,288,32;plugindecoder:(0,24)=*(0,25)=f(0,1),320,32;order:(0,26)=*(0,27)=*(0,28)=f(0,1),352,32;;,640,32;sid_node_to_delete:(0,29)=*(0,30)=(0,31)=xs_OSListNode:,672,32;size:(0,17),704,32;p_name_size:(0,17),736,32;matched:(0,32)=@s16;r(0,32);-32768;32767;,768,16;time:(0,17),800,32;day:(0,17),832,32;year:(0,17),864,32;hour:(0,33)=ar(0,34)=r(0,34);0000000000000;0037777777777;;0;8;(0,6),896,72;mon:(0,35)=ar(0,34);0;3;(0,6),968,32;;char:t(0,6)RuleInfo:t(0,8)_RuleInfo:T(0,9)=s192sigid:(0,17),0,32;level:(0,17),32,32;maxsize:(0,17),64,32;frequency:(0,17),96,32;timeframe:(0,17),128,32;context:(0,13),160,8;firedtimes:(0,17),192,32;time_ignored:(0,17),224,32;ignore_time:(0,17),256,32;ignore:(0,17),288,32;ckignore:(0,17),320,32;group_prev_matched_sz:(0,17),352,32;__frequency:(0,17),384,32;last_events:(0,36)=*(0,5),416,32;alert_opts:(0,15),448,16;context_opts:(0,15),464,16;category:(0,13),480,8;decoded_as:(0,15),496,16;sid_prev_matched:(0,37)=*(0,38)=(0,39)=xs_OSList:,512,32;sid_search:(0,37),544,32;group_prev_matched:(0,40)=*(0,37),576,32;group_search:(0,37),608,32;event_search:(0,41)=*(0,42)=f(0,43)=*(0,1),640,32;group:(0,5),672,32;match:(0,21),704,32;regex:(0,18),736,32;day_time:(0,5),768,32;week_day:(0,5),800,32;srcip:(0,44)=*(0,45)=*(0,46)=(0,47)=xs_os_ip:,832,32;dstip:(0,44),864,32;srcport:(0,21),896,32;dstport:(0,21),928,32;user:(0,21),960,32;url:(0,21),992,32;id:(0,21),1024,32;status:(0,21),1056,32;hostname:(0,21),1088,32;program_name:(0,21),1120,32;extra_data:(0,21),1152,32;action:(0,5),1184,32;comment:(0,5),1216,32;info:(0,5),1248,32;cve:(0,5),1280,32;if_sid:(0,5),1312,32;if_level:(0,5),1344,32;if_group:(0,5),1376,32;if_matched_regex:(0,18),1408,32;if_matched_group:(0,21),1440,32;if_matched_sid:(0,17),1472,32;ar:(0,48)=*(0,49)=*(0,50)=(0,51)=xs_ar:,1504,32;;OSDecoderInfo:t(0,11)u_int8_t:t(0,13)unsigned char:t(0,14)u_int16_t:t(0,15)short unsigned int:t(0,16)int:t(0,17)OSRegex:t(0,19)_OSRegex:T(0,20)=s24error:(0,17),0,32;flags:(0,52)=*(0,17),32,32;patterns:(0,36),64,32;sub_strings:(0,36),96,32;prts_closure:(0,53)=*(0,36),128,32;prts_str:(0,53),160,32;;OSMatch:t(0,22)_OSMatch:T(0,23)=s16error:(0,17),0,32;size:(0,52),32,32;patterns:(0,36),64,32;match_fp:(0,54)=*(0,55)=*(0,56)=f(0,17),96,32;;OSListNode:t(0,30)_OSListNode:T(0,31)=s12next:(0,57)=*(0,31),0,32;prev:(0,57),32,32;data:(0,43),64,32;;short int:t(0,32)long unsigned int:t(0,58)=r(0,58);0000000000000;0037777777777;OSList:t(0,38)_OSList:T(0,39)=s24first_node:(0,29),0,32;last_node:(0,29),32,32;cur_node:(0,29),64,32;currently_size:(0,17),96,32;max_size:(0,17),128,32;free_data_function:(0,24),160,32;;os_ip:t(0,46)_os_ip:T(0,47)=s12ip:(0,5),0,32;ip_address:(0,59)=r(0,59);0000000000000;0037777777777;,32,32;netmask:(0,59),64,32;;active_response:t(0,50)_ar:T(0,51)=s36timeout:(0,17),0,32;location:(0,17),32,32;level:(0,17),64,32;name:(0,5),96,32;command:(0,5),128,32;agent_id:(0,5),160,32;rules_id:(0,5),192,32;rules_group:(0,5),224,32;ar_cmd:(0,60)=*(0,61)=(0,62)=xs_ar_command:,256,32;;unsigned int:t(0,59)ar_command:t(0,61)_ar_command:T(0,62)=s16expect:(0,17),0,32;timeout_allowed:(0,17),32,32;name:(0,5),64,32;executable:(0,5),96,32;;OS_Log:F(0,1)lf:p(0,2)lasts:(0,36)OS_InitFwLog:F(0,1)FW_Log:F(0,17)lf:p(0,2)__local_name:G(0,5)hostname_map:S(0,63)=ar(0,34);0;255;(0,64)=k(0,14)ar_flag:G(0,17)ar_commands:G(0,37)active_responses:G(0,37)currently_rule:G(0,7)_eflog:G(0,65)=*(0,66)=(0,67)=xs__sFILE:FILE:t(0,66)__sFILE:T(0,67)=s88_p:(0,68)=*(0,14),0,32;_r:(0,17),32,32;_w:(0,17),64,32;_flags:(0,32),96,16;_file:(0,32),112,16;_bf:(0,69)=xs__sbuf:,128,64;_lbfsize:(0,17),192,32;_cookie:(0,43),224,32;_close:(0,70)=*(0,71)=f(0,17),256,32;_read:(0,72)=*(0,73)=f(0,17),288,32;_seek:(0,74)=*(0,75)=f(0,76)=(0,77)=(0,78)=(0,79)=@s64;r(0,79);01000000000000000000000;0777777777777777777777;,320,32;_write:(0,80)=*(0,81)=f(0,17),352,32;_ub:(0,69),384,64;_extra:(0,82)=*(0,83)=xs__sFILEX:,448,32;_ur:(0,17),480,32;_ubuf:(0,84)=ar(0,34);0;2;(0,14),512,24;_nbuf:(0,85)=ar(0,34);0;0;(0,14),536,8;_lb:(0,69),544,64;_blksize:(0,17),608,32;_offset:(0,76),640,64;;__sbuf:T(0,69)=s8_base:(0,68),0,32;_size:(0,17),32,32;;fpos_t:t(0,76)__darwin_off_t:t(0,77)__int64_t:t(0,78)long long int:t(0,79)_aflog:G(0,65)_fflog:G(0,65)Config:G(0,86)=(0,87)=xs__Config:_Config:t(0,86)__Config:T(0,87)=s36logall:(0,13),0,8;stats:(0,13),8,8;integrity:(0,13),16,8;syscheck_auto_ignore:(0,13),24,8;syscheck_alert_new:(0,13),32,8;rootcheck:(0,13),40,8;hostinfo:(0,13),48,8;mailbylevel:(0,13),56,8;logbylevel:(0,13),64,8;keeplogdate:(0,13),72,8;mailnotify:(0,32),80,16;ar:(0,17),96,32;memorysize:(0,17),128,32;syscheck_ignore:(0,36),160,32;white_list:(0,44),192,32;hostname_white_list:(0,88)=*(0,21),224,32;includes:(0,36),256,32;;FWDROPpm:G(0,22)FWALLOWpm:G(0,22)