mysql-logs Log Parser by crowdsecurity | CrowdSec Hub

mysql-logs

Log parser

By: crowdsecurity
Version: 0.4

Parse MySQL logs

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via MySQL - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli parsers install crowdsecurity/mysql-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/crowdsecurity/mysql-logs.yaml· 22 linesGitHub

1onsuccess: next_stage1
2name: crowdsecurity/mysql-logs
3description: "Parse MySQL logs"
4filter: "evt.Parsed.program == 'mysql'"2
5pattern_syntax:3
6  MYSQL_ACCESS_DENIED: "Access denied for user '%{DATA:user}'@'%{IP:source_ip}' \\(using password: %{WORD:using_password}\\)" 
7nodes:4
8  - grok:5
9      pattern: "%{TIMESTAMP_ISO8601:time} %{NUMBER} \\[Note\\]( \\[%{DATA:err_code}\\] \\[%{DATA:subsystem}\\])? %{MYSQL_ACCESS_DENIED}"
10      apply_on: message
11  - grok:
12      pattern: "%{TIMESTAMP_ISO8601:time}.*%{NUMBER} Connect.*%{MYSQL_ACCESS_DENIED}"
13      apply_on: message
14statics:6
15  - meta: log_type
16    value: mysql_failed_auth
17  - meta: source_ip
18    expression: "evt.Parsed.source_ip"
19  - target: evt.StrTime
20    expression: evt.Parsed.time
21  - meta: user
22    expression: "evt.Parsed.user"

Installed on

Know where it runs

Documentation

Mysql authentication fail parser.