cscli parsers install crowdsecurity/supavisor-logsParses Supavisor connection pooler logs to detect authentication failures.
118:38:17.778 project=dev_tenant user=postgres region=local mode=transaction type=single app_name=psql peer_ip=123.123.123.123 [error] ClientHandler: Exchange error: "Wrong password" when method :auth_query
| Field | Description |
|---|---|
source_ip | Client IP address |
project | Tenant/project identifier |
db_user | Database user |
log_type | Event classification |
1source: docker2container_name:3 - supabase-supavisor4labels:5 type: supavisor
1name: crowdsecurity/supavisor-logs2description: "Parse Supavisor connection pooler logs for authentication failures"3filter: "evt.Parsed.program == 'supavisor'"4onsuccess: next_stage5debug: false67# Supavisor uses Elixir Logger format with metadata8# Real log example:9# 18:38:17.778 project=dev_tenant user=postgres region=local mode=transaction type=single app_name=psql peer_ip=123.123.123.123 [error] ClientHandler: Exchange error: "Wrong password" when method :auth_query10pattern_syntax:11 SUPAVISOR_TS: '%{TIME:timestamp}\.%{INT:timestamp_ms}'12 SUPAVISOR_LEVEL: '\[%{WORD:log_level}\]'13 SUPAVISOR_META_FULL: 'project=%{DATA:project}\s+user=%{DATA:db_user}\s+region=%{DATA:region}\s+mode=%{DATA:pool_mode}\s+type=%{DATA:pool_type}\s+app_name=%{DATA:app_name}\s+peer_ip=%{IP:source_ip}'14 SUPAVISOR_META_PARTIAL: 'region=%{DATA:region}'1516nodes:17 - grok:18 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_FULL}\s+%{SUPAVISOR_LEVEL}\s+ClientHandler:\s+Exchange error:\s+"Wrong password"%{GREEDYDATA}'19 apply_on: message20 statics:21 - meta: log_type22 value: supavisor_auth_fail23 - meta: service24 value: supavisor25 - meta: source_ip26 expression: evt.Parsed.source_ip27 - target: evt.StrTime28 expression: evt.Parsed.timestamp2930 - grok:31 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_FULL}\s+%{SUPAVISOR_LEVEL}\s+ClientHandler:\s+Tenant is not allowed to connect without SSL%{GREEDYDATA}'32 apply_on: message33 statics:34 - meta: log_type35 value: supavisor_ssl_required36 - meta: service37 value: supavisor38 - meta: source_ip39 expression: evt.Parsed.source_ip40 - target: evt.StrTime41 expression: evt.Parsed.timestamp4243 - grok:44 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_FULL}\s+%{SUPAVISOR_LEVEL}\s+ClientHandler:\s+Exchange error:%{GREEDYDATA:error_detail}'45 apply_on: message46 statics:47 - meta: log_type48 value: supavisor_auth_fail49 - meta: service50 value: supavisor51 - meta: source_ip52 expression: evt.Parsed.source_ip53 - target: evt.StrTime54 expression: evt.Parsed.timestamp5556 - grok:57 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_FULL}\s+%{SUPAVISOR_LEVEL}\s+%{GREEDYDATA:error_message}'58 apply_on: message59 filter: "evt.Parsed.log_level == 'error'"60 statics:61 - meta: log_type62 value: supavisor_error_with_ip63 - meta: service64 value: supavisor65 - meta: source_ip66 expression: evt.Parsed.source_ip67 - target: evt.StrTime68 expression: evt.Parsed.timestamp6970 - grok:71 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_PARTIAL}\s+%{SUPAVISOR_LEVEL}\s+ClientHandler:\s+Client startup message error:\s+:bad_startup_payload'72 apply_on: message73 statics:74 - meta: log_type75 value: supavisor_bad_startup76 - meta: service77 value: supavisor78 - target: evt.StrTime79 expression: evt.Parsed.timestamp8081 - grok:82 pattern: '%{SUPAVISOR_TS}\s+%{SUPAVISOR_META_PARTIAL}\s+%{SUPAVISOR_LEVEL}\s+ClientHandler:\s+User not found:%{GREEDYDATA:enum_detail}'83 apply_on: message84 statics:85 - meta: log_type86 value: supavisor_user_not_found87 - meta: service88 value: supavisor89 - target: evt.StrTime90 expression: evt.Parsed.timestamp9192statics:93 - meta: service94 value: supavisor95