A collection to defend VSFTPD against common attacks :

• VSFTPD parser: crowdsecurity/vsftpd-logs
• bruteforce scenario : crowdsecurity/vsftpd-bf

Example acquisition for this collection :

1filenames:
2  - /var/log/vsftpd/*.log
3labels:
4  type: vsftpd

notes :

• If you are using syslog, set type to syslog instead
• Depending on your distribution/OS, paths to log files might change
• Only relevant if you are manually installing collection