JC Version 1.14.0 Released

Try the jc web demo!

Happy New Year! I’m happy to announce the release of jc version 1.14.0 available on github and pypi.

jc now supports over 60 commands and file-types, including the new hash, hashsum (md5, md5sum, shasum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum), cksum, and wc command parsers. The ls parser has been enhanced to work with vdir output and the env parser has been enhanced to work with printenv output. jc is now fully tested on python 3.9.

jc can be installed via pip or through several official OS package repositories, including Debian, Ubuntu, Fedora, openSUSE, Arch Linux, NixOS Linux, Guix System Linux, FreeBSD, and macOS. For more information on how to get jc, click here.

To upgrade with pip:

$ pip3 install --upgrade jc

New Features

  • jc is now available on the official Debian and Ubuntu repository (apt-get install jc)
  • Tested on python 3.9

New Parsers

jc now supports 61 parsers. New parsers include kv, date, hash, hashsum, cksum, and wc.

Documentation and schemas for all parsers can be found here.

kv key/value pair parser (added in v1.13.2)

Parses key/value pair files. Files can include comments prepended with # or ; and keys and values can be delimited by = or : with or without spaces. Quotation marks are stripped from quoted values, though they can be kept with the -r (raw output) jc argument.

These types of files can be found in many places, including configuration files in /etc. (e.g. /etc/sysconfig/network-scripts).

$ cat keyvalue.txt
# this file contains key/value pairs
name = John Doe
address=555 California Drive
age: 34
; comments can include # or ;
# delimiter can be = or :
# quoted values have quotation marks stripped by default
# but can be preserved with the -r argument
occupation:"Engineer"

$ cat keyvalue.txt | jc --kv -p
{
  "name": "John Doe",
  "address": "555 California Drive",
  "age": "34",
  "occupation": "Engineer"
}

date command parser (added in v1.13.2)

Linux, macOS, and FreeBSD support for the date command:

$ date | jc --date -p          # or:  jc -p date
{
  "year": 2020,
  "month_num": 7,
  "day": 31,
  "hour": 16,
  "minute": 48,
  "second": 11,
  "month": "Jul",
  "weekday": "Fri",
  "weekday_num": 6,
  "timezone": "PDT"
}

hash command parser

Linux, macOS, and FreeBSD support for the hash BASH shell builtin:

$ hash | jc --hash -p
[
  {
    "hits": 2,
    "command": "/bin/cat"
  },
  {
    "hits": 1,
    "command": "/bin/ls"
  }
]

hashsum command parser

Linux, macOS, and FreeBSD support for various MD5 and SHA hash commands, including md5, md5sum, shasum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum:

$ md5sum * | jc --hashsum -p          # or jc -p md5sum *
[
  {
    "filename": "devtoolset-3-gcc-4.9.2-6.el7.x86_64.rpm",
    "hash": "65fc958c1add637ec23c4b137aecf3d3"   
  },
  {
    "filename": "digout",
    "hash": "5b9312ee5aff080927753c63a347707d"
  },
  {
    "filename": "dmidecode.out",
    "hash": "716fd11c2ac00db109281f7110b8fb9d"
  },
  {
    "filename": "file with spaces in the name",
    "hash": "d41d8cd98f00b204e9800998ecf8427e"
  },
  {
    "filename": "id-centos.out",
    "hash": "4295be239a14ad77ef3253103de976d2"
  },
  {
    "filename": "ifcfg.json",
    "hash": "01fda0d9ba9a75618b072e64ff512b43"
  }
]

cksum command parser

Linux, macOS, and FreeBSD support for the cksum and sum commands:

$ cksum * | jc --cksum -p          # or jc -p cksum *
[
  {
    "filename": "__init__.py",
    "checksum": 4294967295,
    "blocks": 0
  },
  {
    "filename": "airport.py",
    "checksum": 2208551092,
    "blocks": 3745
  },
  {
    "filename": "airport_s.py",
    "checksum": 1113817598,
    "blocks": 4572
  }
]

wc command parser

Linux, macOS, and FreeBSD support for the wc command:

$ wc * | jc --wc -p          # or jc -p wc *
[
  {
    "filename": "airport-I.json",
    "lines": 1,
    "words": 30,
    "characters": 307
  },
  {
    "filename": "airport-I.out",
    "lines": 15,
    "words": 33,
    "characters": 348
  },
  {
    "filename": "airport-s.json",
    "lines": 1,
    "words": 202,
    "characters": 2152
  }
]

Updated Parsers

The env parser has been enhanced to work with printenv command output using the “magic” syntax. (e.g. jc printenv)

The ls parser has been enhanced to work with vdir command output using the “magic” syntax. (e.g. jc vdir)

Schema Changes

There are no schema changes in this release.

Full Parser List

  • airport -I
  • airport -s
  • arp
  • blkid
  • cksum
  • crontab
  • crontab-u
  • CSV
  • date
  • df
  • dig
  • dmidecode
  • du
  • env
  • file
  • free
  • fstab
  • /etc/group
  • /etc/gshadow
  • hash
  • hashsum
  • history
  • /etc/hosts
  • id
  • ifconfig
  • INI
  • iptables
  • jobs
  • kv
  • last and lastb
  • ls
  • lsblk
  • lsmod
  • lsof
  • mount
  • netstat
  • ntpq
  • /etc/passwd
  • ping
  • pip list
  • pip show
  • ps
  • route
  • /etc/shadow
  • ss
  • stat
  • sysctl
  • systemctl
  • systemctl list-jobs
  • systemctl list-sockets
  • systemctl list-unit-files
  • timedatectl
  • tracepath
  • traceroute
  • uname -a
  • uptime
  • w
  • wc
  • who
  • XML
  • YAML

For more information on the motivations for creating jc, see my blog post.

Happy parsing!

v1.14.1 Release Changes

  • Add iw-scan parser tested on linux (beta)
  • Update date parser for Ubuntu 20.04 support
  • Update last parser for last -F support
  • Update last parser to add convenience fields and augment data for easier parsing
  • Update man page
  • Minor documentation updates

Schema Changes:

date command parser

A new period field has been added to the schema to represent AM and PM which may appear depending on locale configuration on the host. If the locale does not print AM or PM then the value will be null.

{
  "year":         integer,
  "month_num":    integer,
  "day":          integer,
  "hour":         integer,
  "minute":       integer,
  "second":       integer,
  "period":       string,
  "month":        string,
  "weekday":      string,
  "weekday_num":  integer,
  "timezone":     string
 }

last command parser

The duration field calculation has changed to be more easily parsed and will display as total HOURS:MINUTES. Also, a few convenience calculated fields have been added and will display when the last -F option is used: login_epochlogout_epoch, and duration_seconds.

[
  {
    "user":             string,
    "tty":              string,
    "hostname":         string,
    "login":            string,
    "logout":           string,
    "duration":         string,
    "login_epoch":      integer,   # available with last -F option
    "logout_epoch":     integer,   # available with last -F option
    "duration_seconds": integer    # available with last -F option
  }
]

Published by kellyjonbrazil

I'm a cybersecurity and cloud computing nerd.

Leave a Reply

RSS
Follow by Email
LinkedIn
LinkedIn
Share
%d bloggers like this: