1onsuccess: next_stage
2#debug: true
3filter: "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'segfault'"
4name: crowdsecurity/segfault-logs
5nodes:
6- grok:
7    pattern: '(\[%{DATA}\] )?%{DATA:binary}\[%{INT:pid}\]: segfault at %{DATA:addr} ip %{DATA:rip} sp %{DATA:sp} error %{INT:err_num} in %{DATA:library}\[%{DATA:library_offset}\]( %{DATA})?'
8    apply_on: message
9description: "Parses segfault kernel side"
10statics:
11  - meta: log_type
12    value: kernel
13  - meta: sub_log_type
14    value: segfault
15  - meta: library
16    expression: evt.Parsed.library
17  - meta: errnum
18    expression: evt.Parsed.errnum
19  - meta: binary
20    expression: evt.Parsed.binary
21