lua - nw.log* functions

[RSAAdmin]

The lua parser documentation I have has some notes at the very, very end about debugging lua parsers.  "If you like you can also send information to the log" and references of some nw.log* functions - nw.logDebug, nw.logInfo, nw.logWarning, etc.

What is "the log" as relates to those functions?  When i use these functions I never see anything - I've looked in /var/log/messages and in the log tab in administrator when running against an actual decoder, and checked the NwInvestigator9.log when running it through a local Investigator instance.

When I look at the declaration of those functions in nw-api.lua, they appear to be empty functions (function nw.logDebug(msg) end) -- or are those just the function prototypes and the real work is done in other, lower-level libraries?

Beyond these functions, does anybody have hints or tips or tricks for debugging lua parsers other than registering your values or debugging information as "dummy" meta?

[RSAAdmin]

Okay, just realized that the outputs ARE showing up in NwInvestigator9.log after all.

I'll leave this posted up for posterity's sake and for anybody else who comes looking for debug information for lua parsers, or if anybody has any other hints or tricks that they want to add as well.

[RSAAdmin]

Glad you got it working.

Since you're working with 9.x, be aware that there are differences for a 10+ decoder.  The most important one is that the following will return signed values (which is usually not what you want):

  payload:byte()

  payload:short()

  payload:int()

When you want unsigned values (which is most of the time) you'll need to use:

  payload:uint8()

  payload:uint16()

  payload:uint32()

For nw-api.lua - those function declarations don't do any real work, and lua parsing is in no way dependent upon it.  It's intended to document available parser-specific functions, and for syntax checking your parser as a lua 'dofile'.

[huanzhou1]

Hi I saw the lua parser presentation, just wondering below futures available or not?

Performance!

Parser development tools

Parser performance metrics

Content

Migrate native parsers where applicable

Expand current API

Packet level analysis

[RichardB]

Using NetWitness 11.4.1.2 I found that nw.logDebug() does not show up in /var/log/messages or /var/log/netwitness/decoder/NwServerLog.*.log. However, using nw.logInfo() does show up in both places. Is there any way to view the output of nw.logDebug() ? This is commonly used to log the version of the loaded lua parser.

[WilliamMotley1]

To see log messages at debug level, you'll need to enable debug level logging.  Debug logs are very verbose, not something you'd want to leave enabled all the time.

In the Explore view of Decoder, navigate to /logs/config.  In the entry for "Log Levels (log.levels)" add ",debug".  When you are done, remove ",debug".  Changes take effect immediately.