sonarr-logs Log Parser by schiz0phr3ne | CrowdSec Hub

sonarr-logs

Log parser

By: schiz0phr3ne
Version: 0.2

Parse Sonarr Logs

Install with a top-level collection

1 collection include it

sudo cscli collections install schiz0phr3ne/sonarr

Installs 1 parser and 1 scenario.

View Sonarr - Bruteforce Protection →

Installation

sudo cscli parsers install schiz0phr3ne/sonarr-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/schiz0phr3ne/sonarr-logs.yaml· 29 linesGitHub

1onsuccess: next_stage1
2filter: "evt.Parsed.program in ['mono', 'Sonarr']"2
3name: schiz0phr3ne/sonarr-logs
4description: "Parse Sonarr Logs"
5pattern_syntax:3
6  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"
7nodes:4
8  - grok:5
9      pattern: '^\[Warn\] Auth: Auth-Failure ip %{IP:source_ip} username %{DATA:username}$'
10      apply_on: message
11  - grok:
12      pattern: "%{DATE_YMD:date} %{TIME:time}\\|%{WORD:log_level}\\|Auth\\|Auth-Failure ip %{IPORHOST:source_ip} username '%{NOTDQUOTE:username}'"
13      apply_on: message
14      statics:6
15        - target: evt.Parsed.timestamp
16          expression: "evt.Parsed.date + ' ' + evt.Parsed.time"
17    onsuccess: next_stage4
18
19statics:
20    - meta: log_type
21      value: sonarr_failed_authentication
22    - meta: service
23      value: sonarr
24    - meta: source_ip
25      expression: "evt.Parsed.source_ip"
26    - target: evt.StrTime
27      expression: "evt.Parsed.timestamp"
28    - meta: username
29      expression: evt.Parsed.username

Installed on

Know where it runs

Documentation

Parser for Sonarr Logs.

1---
2source: file
3filenames:
4 - /var/log/syslog
5labels:
6  type: syslog
7---
8source: file
9filenames:
10 - /var/log/sonarr.txt
11labels:
12  type: Sonarr