Proxmox Backup Server Auth Logs

Name: proxmox-backup-auth-logs
Author: nicoh88

Parses authentication logs from Proxmox Backup Server (PBS).

Acquisition

This parser expects logs with the label type: proxmox-backup-auth.

By default, PBS logs authentication events to /var/log/proxmox-backup/api/auth.log.

Example acquis.yaml:

1filenames:
2  - /var/log/proxmox-backup/api/auth.log
3labels:
4  type: proxmox-backup-auth

Debug

successful

1cscli explain --type proxmox-backup-auth --log "2026-02-25T11:07:24+01:00: successful auth for user 'root@pam'"
2line: 2026-02-25T11:07:24+01:00: successful auth for user 'root@pam'
3        ├ s00-raw
4        |       ├ 🔴 crowdsecurity/syslog-logs
5        |       └ 🟢 crowdsecurity/non-syslog (+5 ~8)
6        ├ s01-parse
7        |       ├ 🔴 crowdsecurity/apache2-logs
8        |       ├ 🔴 crowdsecurity/mysql-logs
9        |       ├ 🔴 crowdsecurity/nginx-logs
10        |       ├ 🔴 crowdsecurity/postfix-logs
11        |       ├ 🔴 crowdsecurity/postscreen-logs
12        |       ├ 🔴 proftpd-logs
13        |       └ 🟢 nicoh88/proxmox-backup-auth-logs (+6 ~2)
14        ├ s02-enrich
15        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
16        |       ├ 🔴 crowdsecurity/geoip-enrich
17        |       ├ 🔴 crowdsecurity/http-logs
18        |       ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged)
19        |       └ 🔴 crowdsecurity/whitelists
20        ├-------- parser success 🟢
21        ├ Scenarios

failure

1cscli explain --type proxmox-backup-auth --log "2026-02-25T11:07:18+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:47414 user=
2rootasdasdasd@pbs msg=user account disabled or expired."
3line: 2026-02-25T11:07:18+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:47414 user=rootasdasdasd@pbs msg=user account disabled or expired.
4        ├ s00-raw
5        |       ├ 🔴 crowdsecurity/syslog-logs
6        |       └ 🟢 crowdsecurity/non-syslog (+5 ~8)
7        ├ s01-parse
8        |       ├ 🔴 crowdsecurity/apache2-logs
9        |       ├ 🔴 crowdsecurity/mysql-logs
10        |       ├ 🔴 crowdsecurity/nginx-logs
11        |       ├ 🔴 crowdsecurity/postfix-logs
12        |       ├ 🔴 crowdsecurity/postscreen-logs
13        |       ├ 🔴 proftpd-logs
14        |       └ 🟢 nicoh88/proxmox-backup-auth-logs (+10 ~2)
15        ├ s02-enrich
16        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
17        |       ├ 🟢 crowdsecurity/geoip-enrich (+13)
18        |       ├ 🔴 crowdsecurity/http-logs
19        |       ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged)
20        |       └ 🔴 crowdsecurity/whitelists
21        ├-------- parser success 🟢
22        ├ Scenarios
23                └ 🟢 nicoh88/proxmox-backup-auth-bf

1cscli explain --type proxmox-backup-auth --log "2026-02-25T11:07:33+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:41322 user=
2root@pam msg=authentication error - AUTH_ERR (7)"
3line: 2026-02-25T11:07:33+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:41322 user=root@pam msg=authentication error - AUTH_ERR (7)
4        ├ s00-raw
5        |       ├ 🔴 crowdsecurity/syslog-logs
6        |       └ 🟢 crowdsecurity/non-syslog (+5 ~8)
7        ├ s01-parse
8        |       ├ 🔴 crowdsecurity/apache2-logs
9        |       ├ 🔴 crowdsecurity/mysql-logs
10        |       ├ 🔴 crowdsecurity/nginx-logs
11        |       ├ 🔴 crowdsecurity/postfix-logs
12        |       ├ 🔴 crowdsecurity/postscreen-logs
13        |       ├ 🔴 proftpd-logs
14        |       └ 🟢 nicoh88/proxmox-backup-auth-logs (+10 ~2)
15        ├ s02-enrich
16        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
17        |       ├ 🟢 crowdsecurity/geoip-enrich (+13)
18        |       ├ 🔴 crowdsecurity/http-logs
19        |       ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged)
20        |       └ 🔴 crowdsecurity/whitelists
21        ├-------- parser success 🟢
22        ├ Scenarios
23                └ 🟢 nicoh88/proxmox-backup-auth-bf

1cscli explain --type proxmox-backup-auth --log "2026-02-25T11:07:25+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:41318 user=root@pbs msg=user account disabled or expired."
2line: 2026-02-25T11:07:25+01:00: authentication failure; rhost=[::ffff:31.54.38.23]:41318 user=root@pbs msg=user account disabled or expired.
3        ├ s00-raw
4        |       ├ 🔴 crowdsecurity/syslog-logs
5        |       └ 🟢 crowdsecurity/non-syslog (+5 ~8)
6        ├ s01-parse
7        |       ├ 🔴 crowdsecurity/apache2-logs
8        |       ├ 🔴 crowdsecurity/mysql-logs
9        |       ├ 🔴 crowdsecurity/nginx-logs
10        |       ├ 🔴 crowdsecurity/postfix-logs
11        |       ├ 🔴 crowdsecurity/postscreen-logs
12        |       ├ 🔴 proftpd-logs
13        |       └ 🟢 nicoh88/proxmox-backup-auth-logs (+10 ~2)
14        ├ s02-enrich
15        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
16        |       ├ 🟢 crowdsecurity/geoip-enrich (+13)
17        |       ├ 🔴 crowdsecurity/http-logs
18        |       ├ 🟢 crowdsecurity/public-dns-allowlist (unchanged)
19        |       └ 🔴 crowdsecurity/whitelists
20        ├-------- parser success 🟢
21        ├ Scenarios
22                └ 🟢 nicoh88/proxmox-backup-auth-bf

Hub configuration

« proxmox-backup-auth-logs »
v0.1 by nicoh88
Attack scenario

Proxmox Backup Server Auth Logs

Acquisition

Debug

successful

failure

Hub configuration

« proxmox-backup-auth-logs »v0.1 by nicoh88Attack scenario

Proxmox Backup Server Auth Logs

Acquisition

Debug

successful

failure

« proxmox-backup-auth-logs »
v0.1 by nicoh88
Attack scenario