meshcentral-logs Log Parser by a1ad | CrowdSec Hub

meshcentral-logs

Log parser

By: a1ad
Version: 0.2

Parse meshcentral logs

Install with a top-level collection

1 collection include it

sudo cscli collections install a1ad/meshcentral

Installs 1 parser and 1 scenario.

View meshcentral →

Installation

sudo cscli parsers install a1ad/meshcentral-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/a1ad/meshcentral-logs.yaml· 26 linesGitHub

1
2onsuccess: next_stage1
3#debug: false
4name: a1ad/meshcentral-logs
5description: "Parse meshcentral logs"
6filter: "evt.Parsed.program == 'meshcentral'"2
7pattern_syntax:3
8  MESHCENTRAL_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"
9  MESHCENTRAL_CUSTOMDATE: "%{MONTH} %{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"
10nodes:4
11  - grok:5
12      pattern: '%{MESHCENTRAL_CUSTOMDATE:timestamp}.*Failed password for %{MESHCENTRAL_CUSTOMUSER:username} from %{IP:source_ip}.*'
13      apply_on: message
14      statics:6
15        - meta: log_type
16          value: meshcentral_failed_auth
17
18statics:
19    - meta: service
20      value: meshcentral
21    - meta: user
22      expression: "evt.Parsed.username"
23    - meta: source_ip
24      expression: "evt.Parsed.source_ip"
25    - target: evt.StrTime
26      expression: evt.Parsed.timestamp

Installed on

Know where it runs

Documentation

Parser for Meshcentral Auth Logs.

You need to add the following in the Meshcentral config file before Meshcentral starts logging: "authLog": "/opt/meshcentral/meshcentral-data/auth.log"

1---
2filenames:
3 - /opt/meshcentral/meshcentral-data/auth.log
4labels:
5  type: meshcentral