cscli parsers install fulljackz/proxmox-logsA simple parser for Proxmox VE Web interface. Proxmox VE is listening on port 8006/tcp and write ssh fails into syslog
1Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')2Jan 4 17:34:22 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure
In the first string, the user does not exist. In the second user exists but auth fail.
1Jan 4 17:34:27 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'
1line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')2 ├ s00-raw3 | └ 🟢 crowdsecurity/syslog-logs (first_parser)4 ├ s01-parse5 | └ 🟢 fulljackz/proxmox-logs (+8)6 ├-------- parser success 🟢7 ├ Scenarios8 └ 🟢 fulljackz/proxmox-bf910line: Jan 4 17:34:01 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')11 ├ s00-raw12 | └ 🟢 crowdsecurity/syslog-logs (first_parser)13 ├ s01-parse14 | └ 🟢 fulljackz/proxmox-logs (+8)15 ├-------- parser success 🟢16 ├ Scenarios17 └ 🟢 fulljackz/proxmox-bf1819line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')20 ├ s00-raw21 | └ 🟢 crowdsecurity/syslog-logs (first_parser)22 ├ s01-parse23 | └ 🟢 fulljackz/proxmox-logs (+8)24 ├-------- parser success 🟢25 ├ Scenarios26 └ 🟢 fulljackz/proxmox-bf2728line: Jan 4 17:34:07 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure29 ├ s00-raw30 | └ 🟢 crowdsecurity/syslog-logs (first_parser)31 ├ s01-parse32 | └ 🟢 fulljackz/proxmox-logs (+8)33 ├-------- parser success 🟢34 ├ Scenarios35 └ 🟢 fulljackz/proxmox-bf3637line: Jan 4 17:34:08 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'38 ├ s00-raw39 | └ 🟢 crowdsecurity/syslog-logs (first_parser)40 ├ s01-parse41 | └ 🔴 fulljackz/proxmox-logs42 └-------- parser failure 🔴4344line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')45 ├ s00-raw46 | └ 🟢 crowdsecurity/syslog-logs (first_parser)47 ├ s01-parse48 | └ 🟢 fulljackz/proxmox-logs (+8)49 ├-------- parser success 🟢50 ├ Scenarios51 └ 🟢 fulljackz/proxmox-bf5253line: Jan 4 17:34:11 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'54 ├ s00-raw55 | └ 🟢 crowdsecurity/syslog-logs (first_parser)56 ├ s01-parse57 | └ 🔴 fulljackz/proxmox-logs58 └-------- parser failure 🔴5960line: Jan 4 17:34:12 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure61 ├ s00-raw62 | └ 🟢 crowdsecurity/syslog-logs (first_parser)63 ├ s01-parse64 | └ 🟢 fulljackz/proxmox-logs (+8)65 ├-------- parser success 🟢66 ├ Scenarios67 └ 🟢 fulljackz/proxmox-bf6869line: Jan 4 17:34:13 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'70 ├ s00-raw71 | └ 🟢 crowdsecurity/syslog-logs (first_parser)72 ├ s01-parse73 | └ 🔴 fulljackz/proxmox-logs74 └-------- parser failure 🔴7576line: Jan 4 17:34:02 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure77 ├ s00-raw78 | └ 🟢 crowdsecurity/syslog-logs (first_parser)79 ├ s01-parse80 | └ 🟢 fulljackz/proxmox-logs (+8)81 ├-------- parser success 🟢82 ├ Scenarios83 └ 🟢 fulljackz/proxmox-bf8485line: Jan 4 17:34:03 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'86 ├ s00-raw87 | └ 🟢 crowdsecurity/syslog-logs (first_parser)88 ├ s01-parse89 | └ 🔴 fulljackz/proxmox-logs90 └-------- parser failure 🔴
1#debug: true2name: fulljackz/proxmox-logs3description: "Parse proxmox logs for bruteforce attempts"4filter: "evt.Parsed.program == 'pvedaemon'"5onsuccess: next_stage6pattern_syntax:7 PVE_AUTH_FAIL: 'authentication failure; rhost=%{IP:client_ip} user=%{USERNAME:source_user}@%{WORD:realm} msg='8nodes:9 - grok:10 name: "PVE_AUTH_FAIL"11 apply_on: message12 statics:13 - meta: log_type14 value: pve_failed-auth15 - meta: source_user16 expression: "evt.Parsed.source_user"17statics:18 - meta: service19 value: pvedaemon20 - meta: source_ip21 expression: "evt.Parsed.client_ip"22