Re: prelude-lml regex help.

> Subject: Re: [prelude-user] prelude-lml regex help.
> From: [email protected]
> To: [email protected]
> CC: [email protected]
> Date: Fri, 14 Jan 2011 15:25:14 +0100
> =

> Hi,
> =

> Le jeudi 06 janvier 2011 =E0 12:01 +0000, la Bigmac a =E9crit :
> =

> [...]
> =

> > The issue I am seeing is login events to my linux box
> > (auth.log) are reported to prewikka just fine, but events to cisco.log =
are not
> > being reported. =

> > =

> > =

> > To confirm I had setup the monitoring of the cisco.log file
> > within prelude-lml I setup a tail =96f /var/log/auth.log >>
> > /var/log/remote/cisco.log so all the login event of my linux box were c=
opied to
> > cisco.log this worked and the events were reported to prewikka. =

> > =

> > =

> > My assumption is that I need to look at adding a new regex
> > to single.rules to =91capture=92 the login events. =

> =

> There is some chance that the CISCO events being reported are not
> supported by LML yet. =

> =

> > =

> > The logon events I am looking for are ssh events to a Cisco
> > switch (Nexus 7000) the syslog entry is as follows:
> > =

> > Jan  6 11:33:00
> > 192.168.x.x : 2011 Jan  6 11:34:18 GMT:
> > %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for illegal us=
er
> > wrong5 from 192.168.x.x - sshd[19191]
> > =

> > =

> > I am too embarrassed to post my attempt at a regex=85
> > =

> > =

> > Am I right to continue to work on my regex in single.rules
> > (any help is very welcome) or am I missing something obvious.. =

> =

> It would be better to create a new ruleset specialized for your CISCO
> product. Maybe you could post logs samples on the Prelude bug tracker so
> that we can look at adding support for these new events.
> =

> Regards,
> =

> -- =

> Yoann Vandoorselaere | Directeur Technique/CTO | Prelude Technologies
> Tel: +33 (0)1 40 24 65 10                   Fax: +33 (0)1 40 24 65 28
> http://www.prelude-technologies.com
> =


Thanks Yoann,

I
was just writing a reply to my original post when yours arrived.



I had two issue. =


1 - The date was being entered twice into the syslog.

2 - in /etc/prelude-lml/prelude-lml.conf I needed to add
another format section because the date was in an unrecognised format.

The actual alerts are processed by the standard rule set. =



I now at
least get the failed and successful login events (ssh) which is a start. =





Regards,

 =


Mat.   =








 		 	   		  =

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user