Re: ntsyslog events detection failed

2009/12/3 Veaceslav Grecea
> 2009/12/3 Paul Robert Marino:
>> Veaceslav Grecea wrote:
>>> Dec  2 17:17:30 1.1.1.1 NODE NT: <Security;F529;NT AUTHORITY\SYSTEM>
>>> Logon Failure:  Reason:Unknown user name or bad password  User
>>> Name:username  Domain:dname  Logon Type:3  Logon Process:NtLmSsp
>>> Authentication Package:NTLM  Workstation Name:376K4  Caller User
>>> Name:-  Caller Domain:-  Caller Logon ID:-  Caller Process ID:-
>>> Transited Services:-  Source Network Address:1.1.2.4  Source Port:0
>> is this a multi line message in the file?
> No, it's an one line message.
> A copy-paste error.
Dec  2 16:18:21 1.1.1.220 WEB220 NT: <Security;S540;WEB220\username>
Successful Network Logon:  User Name:username  Domain:WEB220  Logon
ID:(0x0,0x2F9102E)  Logon Type:3  Logon Process:NtLmSsp
Authentication Package:NTLM Workstation Name:USER-NAME  Logon GUID:-
Caller User Name:-  Caller Domain:-  Caller Logon ID:-  Caller Process
ID: -  Transited Services: -  Source Network Address:1.1.50.29 Source
Port:0

I rewrote prefix-regex rule:
prefix-regex = "^(?P<timestamp>.{15}) .{12} (?P<hostname>[^:]+)[:]
<.+\\(?P<username>[^>]+)> ?(?P<process>.+)?"
Username, according to off documetation is not used. But anyway, I have set:

timestamp = Dec  2 17:17:30
hostname = NODE NT
process = Successful Network Logon:  User Name:username  Domain:WEB220
 Logon ID:(0x0,0x2F9102E)  Logon Type:3  Logon Process:NtLmSsp
Authentication Package:NTLM Workstation Name:USER-NAME  Logon GUID:-
Caller User Name:-  Caller Domain:-  Caller Logon ID:-  Caller Process
ID: -  Transited Services: -  Source Network Address:1.1.50.29 Source
Port:0

with no luck.
I have all unix based events registered, but not Windows one.
What is wrong with my settings ?
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user