From dc67b24270a972b7097fc039692f557330d859a6 Mon Sep 17 00:00:00 2001 From: pigsyn Date: Wed, 12 Dec 2012 23:07:39 +0100 Subject: [PATCH 1/4] Update config/filter.d/webmin-auth.conf Added a trailing '.*$' to each regex so they can find expressions in targeted log files. --- config/filter.d/webmin-auth.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf index 70997e01..fc0b7760 100644 --- a/config/filter.d/webmin-auth.conf +++ b/config/filter.d/webmin-auth.conf @@ -18,8 +18,8 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = webmin.* Non-existent login as .+ from $ - webmin.* Invalid login as .+ from $ +failregex = webmin.* Non-existent login as .+ from .*$ + webmin.* Invalid login as .+ from .*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From f336d9f8765e8e6eafb9c683caeffaa5a4c5c34d Mon Sep 17 00:00:00 2001 From: pigsyn Date: Thu, 13 Dec 2012 08:14:49 +0100 Subject: [PATCH 2/4] Update config/filter.d/webmin-auth.conf Added '\s*$' to the regular expression to match the space written by webmin logs at line-endings --- config/filter.d/webmin-auth.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf index fc0b7760..b1df45dc 100644 --- a/config/filter.d/webmin-auth.conf +++ b/config/filter.d/webmin-auth.conf @@ -18,8 +18,8 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = webmin.* Non-existent login as .+ from .*$ - webmin.* Invalid login as .+ from .*$ +failregex = webmin.* Non-existent login as .+ from \s*$ + webmin.* Invalid login as .+ from \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 38dd1506cc631f0ee5900a4e01b1c615d4e2716e Mon Sep 17 00:00:00 2001 From: pigsyn Date: Wed, 12 Dec 2012 23:25:31 -0800 Subject: [PATCH 3/4] Sample Webmin logs --- testcases/files/logs/Webmin | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 testcases/files/logs/Webmin diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/Webmin new file mode 100644 index 00000000..4be0f1c4 --- /dev/null +++ b/testcases/files/logs/Webmin @@ -0,0 +1,7 @@ +# Webmin authentication failures from /var/log/auth.log + +#1 User exists, bad password +Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230 + +#2 User does not exists +Dec 12 23:14:19 sb1 webmin[22134]: Non-existent login as robert from 188.40.105.142 From 123d457924f814d17c29398bad909002283a6805 Mon Sep 17 00:00:00 2001 From: pigsyn Date: Thu, 13 Dec 2012 08:33:07 +0100 Subject: [PATCH 4/4] Update testcases/files/logs/Webmin --- testcases/files/logs/Webmin | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/Webmin index 4be0f1c4..86d3f321 100644 --- a/testcases/files/logs/Webmin +++ b/testcases/files/logs/Webmin @@ -1,4 +1,4 @@ -# Webmin authentication failures from /var/log/auth.log +#Webmin authentication failures from /var/log/auth.log #1 User exists, bad password Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230