HEX
Server: Apache
System: Linux sg241.singhost.net 2.6.32-896.16.1.lve1.4.51.el6.x86_64 #1 SMP Wed Jan 17 13:19:23 EST 2018 x86_64
User: honghock (909)
PHP: 8.0.30
Disabled: passthru,system,shell_exec,show_source,exec,popen,proc_open
Upload Files
File: //opt/osquery/share/osquery/lenses/cron_user.aug
(*
Module: Cron_User
 Parses /var/spool/cron/*

Author: David Lutterkort <lutter@watzmann.net>

About: Reference
 This lens parses the user crontab files in /var/spool/cron. It produces
 almost the same tree as the Cron.lns, except that it never contains a user
 field.

About: License
  This file is licensed under the LGPL v2+, like the rest of Augeas.

About: Lens Usage
  Sample usage of this lens in augtool

    * Get the entry that launches '/usr/bin/ls'
      >  match '/files/var/spool/cron/foo/entry[. = "/usr/bin/ls"]'

About: Configuration files
  This lens applies to /var/spool/cron*. See <filter>.
 *)
module Cron_User =
  autoload xfm

(************************************************************************
 * View: entry
 *   A crontab entry for a user's crontab
 *************************************************************************)
let entry        = [ label "entry" . Cron.indent
                   . Cron.prefix?
                   . ( Cron.time | Cron.schedule )
                   . Cron.sep_spc . store Rx.space_in . Cron.eol ]

(*
 * View: lns
 *   The cron_user lens. Almost identical to Cron.lns
 *)
let lns = ( Cron.empty | Cron.comment | Cron.shellvar | entry )*

let filter =
  incl "/var/spool/cron/*" .
  Util.stdexcl

let xfm = transform lns filter