From b3bd877d23e578e12791c6db4ca9fd82108d75c3 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 30 Apr 2013 07:48:01 +1000 Subject: [PATCH 1/5] BF: change common.conf to handle formats of syslog -v and syslog -vv in BSD --- config/filter.d/common.conf | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index 18bf41c5..a5fe1176 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -41,7 +41,10 @@ __hostname = \S+ # # Common line prefixes (beginnings) which could be used in filters # -# [hostname] [vserver tag] daemon_id spaces -# this can be optional (for instance if we match named native log files) -__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* - +# [bsdverbose]? [hostname] [vserver tag] daemon_id spaces +# +# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or +# appearing before the host as per testcases/files/logs/bsd/*. +# +# This can be optional (for instance if we match named native log files) +__prefix_line = \s*(<[^.]+.[^.]+>)?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* From cde710803367b8529cde6093232ca1151d20ddd7 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 29 Apr 2013 13:47:33 +1000 Subject: [PATCH 2/5] DOC: bsd syslog files thanks to Nick Hilliard --- testcases/files/logs/bsd/syslog-plain.txt | 3 +++ testcases/files/logs/bsd/syslog-v.txt | 10 ++++++++++ testcases/files/logs/bsd/syslog-vv.txt | 5 +++++ 3 files changed, 18 insertions(+) create mode 100644 testcases/files/logs/bsd/syslog-plain.txt create mode 100644 testcases/files/logs/bsd/syslog-v.txt create mode 100644 testcases/files/logs/bsd/syslog-vv.txt diff --git a/testcases/files/logs/bsd/syslog-plain.txt b/testcases/files/logs/bsd/syslog-plain.txt new file mode 100644 index 00000000..7dcecb2e --- /dev/null +++ b/testcases/files/logs/bsd/syslog-plain.txt @@ -0,0 +1,3 @@ +Apr 2 17:52:55 pancake sshd[55657]: Invalid user oracle from 192.0.2.100 +Apr 2 17:53:01 pancake sshd[55657]: error: PAM: authentication error for illegal user oracle from test.example.com +Apr 2 17:53:01 pancake sshd[55657]: Failed keyboard-interactive/pam for invalid user oracle from 192.0.2.100 port 48856 ssh2 diff --git a/testcases/files/logs/bsd/syslog-v.txt b/testcases/files/logs/bsd/syslog-v.txt new file mode 100644 index 00000000..319582ba --- /dev/null +++ b/testcases/files/logs/bsd/syslog-v.txt @@ -0,0 +1,10 @@ +Apr 2 17:51:27 <4.3> pancake sshd[55624]: error: PAM: authentication error for nick from test.example.com +Apr 2 17:51:32 <4.6> pancake sshd[55628]: Invalid user r00t from 192.0.2.100 +Apr 2 17:51:33 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com +Apr 2 17:51:33 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2 +Apr 2 17:51:34 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com +Apr 2 17:51:34 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2 +Apr 2 17:51:36 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com +Apr 2 17:51:36 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2 +Apr 2 17:52:06 <4.6> pancake sshd[55647]: Invalid user oracle from 192.0.2.100 +Apr 2 17:52:07 <4.3> pancake sshd[55647]: error: PAM: authentication error for illegal user oracle from test.example.com diff --git a/testcases/files/logs/bsd/syslog-vv.txt b/testcases/files/logs/bsd/syslog-vv.txt new file mode 100644 index 00000000..74143226 --- /dev/null +++ b/testcases/files/logs/bsd/syslog-vv.txt @@ -0,0 +1,5 @@ +Mar 19 23:48:18 pancake sshd[55517]: Invalid user r00t from 183.60.159.20 +Mar 19 23:48:20 pancake sshd[55519]: Invalid user r00t from 183.60.159.20 +Mar 19 23:50:03 pancake sshd[55604]: Invalid user http from 183.60.159.20 +Mar 19 23:50:05 pancake sshd[55606]: Invalid user kylix from 183.60.159.20 +Mar 19 23:50:08 pancake sshd[55608]: Invalid user nagios from 183.60.159.20 From ebfab512bc7618365ea8eaf64f4039ea709c6f5b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 3 May 2013 16:15:26 +1000 Subject: [PATCH 3/5] DOC: credits for bsd log --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c80e3b3c..24a88587 100644 --- a/ChangeLog +++ b/ChangeLog @@ -50,6 +50,8 @@ Borreli, blotus: gh-70. Thanks to iGeorgeX for the idea. blotus * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 + Christoph Theis, Nick Hilliard, Daniel Black + * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD - New features: Yaroslav Halchenko * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} From 54c2bf3dfb71b164f5b6a1abe2e6e480499502fa Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 3 May 2013 17:14:20 +1000 Subject: [PATCH 4/5] BF: missed MANIFEST include --- MANIFEST | 3 +++ 1 file changed, 3 insertions(+) diff --git a/MANIFEST b/MANIFEST index 364c0b08..05eb35b1 100644 --- a/MANIFEST +++ b/MANIFEST @@ -43,6 +43,9 @@ server/datetemplate.py server/mytime.py server/failregex.py testcases/files/testcase-usedns.log +testcases/files/logs/bsd/syslog-plain.txt +testcases/files/logs/bsd/syslog-v.txt +testcases/files/logs/bsd/syslog-vv.txt testcases/banmanagertestcase.py testcases/failmanagertestcase.py testcases/clientreadertestcase.py From de563476197d2d6a15082801d3d49daa8d7bc9a9 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 8 May 2013 06:32:27 +1000 Subject: [PATCH 5/5] ENH: separate out regex and escape a . --- config/filter.d/common.conf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index a5fe1176..4bd519b3 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -38,6 +38,9 @@ __kernel_prefix = kernel: \[\d+\.\d+\] __hostname = \S+ + +__bsd_syslog_verbose = (<[^.]+\.[^.]+>) + # # Common line prefixes (beginnings) which could be used in filters # @@ -47,4 +50,4 @@ __hostname = \S+ # appearing before the host as per testcases/files/logs/bsd/*. # # This can be optional (for instance if we match named native log files) -__prefix_line = \s*(<[^.]+.[^.]+>)?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* +__prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*