cscli parsers install pserranoa/openvpnA parser for openvpn Community logs.
1--verb n23Set output verbosity to n (default 1). Each level shows all info from the previous levels. Level 3 is recommended if you want a good summary of what's happening without being swamped by output.
1filter: "evt.Line.Labels.type == 'openvpn' || evt.Parsed.program in ['openvpn', 'ovpn-server']"2onsuccess: next_stage3name: pserranoa/openvpn4description: "Parse openvpn logs"5pattern_syntax:6 OPENVPN_TLS_AUTH_ERROR: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:sport} TLS Auth Error:.*"7 OPENVPN_AUTH_FAILED: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:sport} AUTH: Received control message: AUTH_FAILED"8 OPENVPN_SYSLOG_AUTH_FAILED: "AUTH: Received control message: AUTH_FAILED.*\\[AF_INET\\]%{IPV4:source_ip}:%{INT:sport}"9 OPENVPN_AUTH_VERIFY_ERROR: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:source_port} VERIFY ERROR:.*"10 OPENVPN_TLS_CRYPT: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:sport} TLS Error: tls-crypt unwrapping failed from.*"11 OPENVPN_SYSLOG_TLS_CRYPT: "TLS Error: tls-crypt unwrapping failed from \\[AF_INET\\]%{IPV4:source_ip}:%{INT:sport}"12 OPENVPN_TLS_PACKET: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:sport} TLS Error: incoming packet authentication failed from.*"13 OPENVPN_TLS_HANDSHAKE: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:sport} TLS Error: TLS handshake failed from.*"14 OPENVPN_TLS_CERT: "%{TIMESTAMP_ISO8601:timestamp} (?:%{WORD:client}/|)%{IPV4:source_ip}:%{INT:source_port} OpenSSL: error:%{WORD}:.*verify failed"15nodes:16 - grok:17 name: "OPENVPN_TLS_AUTH_ERROR"18 apply_on: message19 - grok:20 name: "OPENVPN_AUTH_FAILED"21 apply_on: message22 - grok:23 name: "OPENVPN_SYSLOG_AUTH_FAILED"24 apply_on: message25 - grok:26 name: "OPENVPN_AUTH_VERIFY_ERROR"27 apply_on: message28 - grok:29 name: "OPENVPN_TLS_CRYPT"30 apply_on: message31 - grok:32 name: "OPENVPN_SYSLOG_TLS_CRYPT"33 apply_on: message34 - grok:35 name: "OPENVPN_TLS_PACKET"36 apply_on: message37 - grok:38 name: "OPENVPN_TLS_HANDSHAKE"39 apply_on: message40 - grok:41 name: "OPENVPN_TLS_CERT"42 apply_on: message43statics:44 - meta: service45 value: openvpn46 - meta: source_ip47 expression: "evt.Parsed.source_ip"48 - meta: log_type49 value: auth_failed50 - target: evt.StrTime51 expression: "evt.Parsed.timestamp != '' ? evt.Parsed.timestamp : evt.Parsed.timestamp8601"52