Errors in nessusd.dump

#TRUSTED 5f4a5cdf153118cf61169d3863e0c43ee10194f63b5aed9367df8effab4316d6e99c11e50c9527ab387dae171078b18389185d87e696563507f41a7a29aa1e8060289df35673ed4a66dd65b29092c108c121870a78d8367d1f250d3c66f7691e644adee53d2c7d3cf6912034f34c240e86a5c7b769ecf00c4f1caddc846d4a83027cb83c0d7cb6c1cfdc921916b249fbef8ff71e5af09a36b7596f3d0a502c85296b6ec3d5215507a2e1f08feb1f207f1c602ec6792cf3f31547b7cc01a0ba01a84a8e7a62daf4fe5a436a4a81a213db4303b6131d0f559674d1d42f0d3ce79de1a287126d89fabe8e10640bae3c0a3f734f9188a1815b066ad5abd15bca34dc3f1cd355cc3d30808897a5002bd11edbd440ab83b73f7e8ada6fac4501f93751605dc156b4908c4b2827c16d3486f67fc052855ae2572df05a4af1c63d33167d86248183608371d8aea360c4a2b77eb4053c7f4ea8969d3765153c769417beab0a0d448c045030899a67b286c7ef05129bffc3e8a944d393f7ad9d8498c11b0fb8482aaebbfeb082e075cf4485ac01b0e76e761f5fe36dd9e3a01a854032d122609016e9450d6350ac748395fb64b70f612f63ed2c1ec25b54a518cf02982a2c4e393fc3440847c39efadb995e0d945e425459ec03927b935b8b840a731f69847996e1429e647b9c32b57132f0bf9582d8f4ec26f96e39ace52bdd5227c56e77
#TRUST-RSA-SHA256 13f1c77140ff3d2b564654799f1d3b8ee264cdc70578cf28cac618ab42f3f558b3dac4be54aeae8bd4e3015d0ebfadbda8b33bf54af8830a9b60b82d1f87682802b49c30ea6d589418b6f46f99380f3215a5973876981430b673a1def6bc0cca5f4f4c5b8f20129e4891d83aa01896ba357571b94a5074b4f06c2f01fde955c8b797ff1a9cfcef01ab9195d0ccf4d31c3a5b90d2c210243317b0db21e0f7bed7c3aa838ab89b9deb5a75f9d5136e7b8d4f6681c712583202d8cdfecb8b579a67ac2a2a479b0d18188261194582b329c40e571de4951097c0899b9ddd568786771c4197de4c1ca0b8f719c51d029e6cdb102e9a5ed1404b1a562e17a32682dbc1f67f23664c2b98fcb32a5e9d5ad5ced2d7990fb03b2c05ed25b5b5354ba690e06fb45615d5e207541274c30bd257bdc4178199b2461ef87cd529ff44f34afd28b45441a3eaa4a362a8e5db4b7bae0293e31477a5e295bd96a733d9ad493f446afc64287dca911db4e126030d2093224b1fe165bdefa57dd0c2042804e70c075a9471cd3ae73a6fe08ec8c9c6f768b93d82dad3a0579de73fbd19ed5aa8dedfc099c289eeb7299692a5c29dc81d2cbaa8221d83c0d16eb83b707a38eec86d783e88c8a26e16cc9f2717487c7859229bc02c34a537077b3f973d076dec4a417d11f0bfe7098d4effd2f66a310bdc1edade02262a37d4edd844ab2a7bdc605cd2e4
#
# (C) Tenable Network Security, Inc.
#

include 'compat.inc';

var SCRIPT_TIMEOUT = 5 * 60;

if (description)
{
  script_id(117530);
  script_version("1.13");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/09");

  script_name(english:"Errors in nessusd.dump");
  script_summary(english:"Parses out errors occuring in the nessusd.dump file.");
  script_set_attribute(
    attribute:"synopsis",
    value:
      'This plugin parses information from the nessusd.dump log\n'
      'file and reports on errors.'
  );
  script_set_attribute(
    attribute:"description",
    value:
      'This plugin parses information from the nessusd.dump log\n'
      'file and reports on errors.'
  );
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2018/09/17");

  script_set_attribute(attribute:"plugin_type", value:"settings");
  script_end_attributes();

  script_category(ACT_END2);
  script_family(english:"General");
  script_copyright(english:"This script is Copyright (C) 2018-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_timeout(SCRIPT_TIMEOUT);
  script_require_keys("global_settings/enable_plugin_debugging");
  script_exclude_keys("Host/msp_scanner");

  exit(0);
}

include 'datetime.inc';
include 'nessusd_logs.inc';
include 'nessusd_product_info.inc';

# Amend the script timeout if it was modified by the preference
if (get_preference('timeout.117530'))
  SCRIPT_TIMEOUT = int(get_preference('timeout.117530'));

global_var SCRIPT_CUTOFF = unixtime() + SCRIPT_TIMEOUT - 10;

get_kb_item_or_exit('global_settings/enable_plugin_debugging');

# Suppress plugin on T.io
if (get_kb_item("Host/msp_scanner"))
{
  exit(0, "This plugin does not run on T.io scanner systems.");
}

# This is here to prevent license issues on SC and TIO.
# Because this plugin could count against SC/TIO license we makes
# sure that ports have been detected on the target client which
# tells us the target is a valid asset
var tcp_ports = get_kb_list("Ports/tcp/*");
var udp_ports = get_kb_list("Ports/udp/*");
if (!nessusd_is_agent() && isnull(tcp_ports) && isnull(udp_ports))
  exit(0, "No ports available, port detection prevents reporting on targets with no host-based scan results.");

dump::get_scan_info();
if (isnull(dump::SCAN_INFO.uuid))
  exit(0, "This plugin is not for use with command line scans.");

if (isnull(dump::SCAN_INFO.start_time))
  exit(0, "No valid start time for this scan was found in the report DB.");

var nessus_dir = nessus_get_dir(N_LOG_DIR);
var dirslash = '/';
if (platform() == 'WINDOWS')
  dirslash = "\";

var dumpfile = nessus_dir + dirslash + 'nessusd.dump';
if (isnull(file_stat(dumpfile)))
  exit(1, "The nessus dump log at: " + dumpfile + ", does not exist.");

var fd_dump = file_open(name:dumpfile, mode:'r');
if (!fd_dump || fd_dump < 0)
  exit(1, "Failed to open the dump log file.");

var seeker = file_seek(fp:fd_dump, offset:0, whence:SEEK_END);
if (seeker < 0 || isnull(seeker))
  exit(1, "Failed to read the dump log file.");

var MAX_ATTACHMENT_SIZE = 1024 * 1024 * 35;
if (defined_func("set_mem_limits"))
  set_mem_limits(max_alloc_size:MAX_ATTACHMENT_SIZE * 2, max_program_size:MAX_ATTACHMENT_SIZE * 2);

var dumps = '';
var dump_size = 0;
var dumping_plugins = make_array(
  dump::CRITICAL, {},
  dump::ERROR, {},
  dump::WARNING, {},
  dump::INFO, {},
  dump::DEBUG, {},
  dump::DEBUG_VERBOSE, {},
  dump::UNKNOWN, {}
);
var collect = false;
var time, info;
var stack_buf = '';
var line = '';
var cutoff_reached = false;

while (dump::read_line(fd:fd_dump, buf:line, reverse:true))
{
  # Stop reading before we timeout to
  if (unixtime() > SCRIPT_CUTOFF)
  {
    cutoff_reached = true;
    break;
  }

  time = pregmatch(pattern:NESSUSD_LOG_TIME_REGEX, string:line);
  if (isnull(time) || empty_or_null(object:time[1]))
  {
    stack_buf = strcat(line, '\n', stack_buf);
    continue;
  }

  time = logtime_to_unixtime(timestr:time[1]);
  if (!isnull(time) && time < dump::SCAN_INFO.start_time)
    break;

  info = dump::parse_log_info(line:line);
  if (isnull(info))
    continue;

  if (!info.plugin || info.scan != dump::SCAN_INFO.uuid || !dump::is_scan_target(info.target))
  {
    stack_buf = '';
    continue;
  }

  info.severity = dump::get_log_severity(info.severity);
  if (dumping_plugins[info.severity][info.plugin])
    dumping_plugins[info.severity][info.plugin]++;
  else
    dumping_plugins[info.severity][info.plugin] = 1;

  if ("Recursive foreach" >< line)
    report_xml_tag(tag:"recursive-foreach", value:info.plugin);
  if ("Bad enumerator" >< line)
    report_xml_tag(tag:"bad-enumerator", value:info.plugin);

  dump_size += strlen(line) + 1 + strlen(stack_buf);
  if (dump_size <= MAX_ATTACHMENT_SIZE)
    dumps = strcat(line, '\n', stack_buf, dumps);

  stack_buf = '';
}

file_close(fd_dump);

var report;
for (var severity in dumping_plugins)
{
  if (empty_or_null(object:dumping_plugins[severity]))
    continue;

  report += strcat('\n  ', severity, 's:\n');
  for (var plugin in dumping_plugins[severity])
  {
    report += strcat('    - ', plugin, ' reported ', dumping_plugins[severity][plugin], ' log');
    if (dumping_plugins[severity][plugin] > 1)
      report += 's';

    report += '\n';
  }
}

if (isnull(report))
{
  if (cutoff_reached)
    exit(0, 'No dump logs were found before the plugin had to stop reading the log file.');

  exit(0, 'No plugin generated dump errors for this host.');
}

report = strcat('The nessusd.dump log file contained logs from the following plugins:\n', report);

if (dump_size > MAX_ATTACHMENT_SIZE)
  report += '\nNote: The dump file has been truncated to 35MB due to its size.';

if (cutoff_reached)
  report += '\nNote: The plugin had to stop parsing dump logs to avoid timing out.'
            '\nThere may be more logs to parse in the dump logs.';

var attachments = [
  {
    type: 'text/plain',
    name: 'nessusd.dump',
    value: dumps
  }
];

security_report_with_attachments(
  port:0,
  level:0,
  extra:report,
  attachments:attachments
);