cscli parsers install crowdsecurity/synology-dsm-logsA parser for Synology DSM web authentication (failed) logs.
Those logs are usually present in /var/log/auth.log.
Example acquisition:
1filenames:2 - /var/log/auth.log3labels:4 type: syslog
1# Synology DSM auth.log2#debug: true3filter: "evt.Parsed.program matches 'synoscgi_SYNO.API.Auth_[1-9]([0-9])?_login'"4name: crowdsecurity/synology-dsm-logs5description: "Parse Synology DSM web auth logs"6onsuccess: next_stage7format: 2.08pattern_syntax:9 TIMESTAMP: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY}T%{HOUR}:%{MINUTE}:%{SECOND}+%{ISO8601_TIMEZONE}'10# The IP grok pattern that ships with crowdsec is buggy and does not capture the last digit of an IP if it is the last thing it matches, and the last octet starts with a 211# https://github.com/crowdsecurity/crowdsec/issues/93812 IPv4_WORKAROUND: '(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'13 IP_WORKAROUND: '(?:%{IPV6}|%{IPv4_WORKAROUND})'14 AUTH_LOG_FAIL: 'pam_unix\(webui:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=%{IP_WORKAROUND:src_ip}'15grok:16 pattern: "%{AUTH_LOG_FAIL}"17 apply_on: message18 statics:19 - meta: log_type20 value: synology-dsm_failed_auth21statics:22 - meta: log_type23 value: synology-dsm_failed_auth24 - meta: service25 value: synology-dsm26 - meta: source_ip27 expression: "evt.Parsed.src_ip"28