Sshd-logs parser: problems with log files

Hello everybody,
I was testing Crowdsec in several syslog-based files to watch ssh logins. I have used the command cscli explain -f XXXX --failures -t syslog with the official Crowdsec docker image and I have found that, in spite of the fact that syslog parser is working in my first test, the sshd-logs parser is not acting adequately.

Firstly, an example working correctly extracted from a Debian-based-distro’s /var/log/auth.log:

Oct 29 00:37:56 bananapipro sshd[23082]: Failed password for nicux from XX.XX.XX.XX port 45874 ssh2

The aforementioned cscli command prints nothing (no failures).

In contrast, when I use an Alpine LInux’s /var/log/messages.log the sshd-logs parser fails and, therefore, cscli prints:
line: Oct 29 00:06:10 rpi auth.info sshd[26197]: Failed password for nicux from XX.XX.XX.XX port 45866 ssh2
├ s00-raw
| ├ :red_circle: crowdsecurity/docker-logs
| └ :green_circle: crowdsecurity/syslog-logs (first_parser)
├ s01-parse
| ├ :red_circle: crowdsecurity/sshd-logs
| └ :red_circle: crowdsecurity/traefik-logs
└-------- parser failure :red_circle:

On the other hand, my third test was with a Docker image from linuxserver.io (linuxserver/openssh-server - LinuxServer.io). In this case, they do not use syslog exactly, but s6-log, and the s00 parsers fail, as expected:
line: 2022-10-26 23:43:54.665316842 Connection closed by authenticating user nicux XX.XX.XX.XX port 45826 [preauth]
├ s00-raw
| ├ :red_circle: crowdsecurity/docker-logs
| ├ :red_circle: crowdsecurity/non-syslog
| └ :red_circle: crowdsecurity/syslog-logs
└-------- parser failure :red_circle:
I was checking the syslog parser syntax in https://docs.crowdsec.net/docs/parsers/patterns/ and I wonder if TIMESTAMP_ISO8601 pattern should work with this text and why the parser is not working exactly.

I am a newbie with respect to write/modify the Crowdsec’s parsers and I don’t know if somebody is interested in including these cases in the parsers.

Realised after reading the post deeper my first reply completely missed the point.

The second log line fails because there is a space inbetween rpi and auth.info if they line was together it would work:

line: Oct 29 00:06:10 rpi.auth.info sshd[26197]: Failed password for nicux from 10.10.10.10 port 45866 ssh2
├ s00-raw
| └ :green_circle: crowdsecurity/syslog-logs (first_parser)
├ s01-parse
| ├ :red_circle: LePresidente/authelia-logs
| ├ :red_circle: LePresidente/emby-logs
| ├ :red_circle: LePresidente/gitea-logs
| ├ :red_circle: LePresidente/jellyseerr-logs
| ├ :red_circle: LePresidente/ombi-logs
| ├ :red_circle: baudneo/gotify-logs
| ├ :red_circle: crowdsecurity/apache2-logs
| ├ :red_circle: crowdsecurity/asterisk-logs
| ├ :red_circle: crowdsecurity/caddy-logs
| ├ :red_circle: crowdsecurity/cpanel-logs
| ├ :red_circle: crowdsecurity/dovecot-logs
| ├ :red_circle: crowdsecurity/dropbear-logs
| ├ :red_circle: crowdsecurity/endlessh-logs
| ├ :red_circle: crowdsecurity/exchange-imap-logs
| ├ :red_circle: crowdsecurity/exchange-pop-logs
| ├ :red_circle: crowdsecurity/exchange-smtp-logs
| ├ :red_circle: crowdsecurity/fastly-logs
| ├ :red_circle: crowdsecurity/haproxy-logs
| ├ :red_circle: crowdsecurity/home-assistant-logs
| ├ :red_circle: crowdsecurity/iis-logs
| ├ :red_circle: crowdsecurity/iptables-logs
| ├ :red_circle: crowdsecurity/litespeed-logs
| ├ :red_circle: crowdsecurity/magento-extension-logs
| ├ :red_circle: crowdsecurity/mariadb-logs
| ├ :red_circle: crowdsecurity/modsecurity
| ├ :red_circle: crowdsecurity/mssql-logs
| ├ :red_circle: crowdsecurity/mysql-logs
| ├ :red_circle: crowdsecurity/nextcloud-logs
| ├ :red_circle: crowdsecurity/nginx-logs
| ├ :red_circle: crowdsecurity/nginx-proxy-manager-logs
| ├ :red_circle: crowdsecurity/odoo-logs
| ├ :red_circle: crowdsecurity/opnsense-gui-logs
| ├ :red_circle: crowdsecurity/pgsql-logs
| ├ :red_circle: crowdsecurity/pkexec-logs
| ├ :red_circle: crowdsecurity/postfix-logs
| ├ :red_circle: crowdsecurity/postscreen-logs
| ├ :red_circle: crowdsecurity/smb-logs
| ├ :green_circle: crowdsecurity/sshd-logs (+9 ~1)
| ├ update evt.Stage : s01-parse → s02-enrich
| ├ create evt.Parsed.sshd_auth_type : password
| ├ create evt.Parsed.sshd_client_ip : 10.10.10.10
| ├ create evt.Parsed.sshd_invalid_user : nicux
| ├ create evt.Parsed.sshd_port : 45866
| ├ create evt.Parsed.sshd_protocol : ssh2
| ├ create evt.Meta.service : ssh
| ├ create evt.Meta.source_ip : 10.10.10.10
| ├ create evt.Meta.target_user : nicux
| ├ create evt.Meta.log_type : ssh_failed-auth
| ├ :red_circle: firewall-services/lemonldap-ng-logs
| ├ :red_circle: firewallservices/pf-logs
| ├ :red_circle: firewallservices/pf-logs-drop
| ├ :red_circle: fulljackz/proxmox-logs
| ├ :red_circle: fulljackz/pureftpd-logs
| ├ :red_circle: hitech95/nginx-mail-logs
| ├ :red_circle: jusabatier/apereo-cas-audit-logs
| ├ :red_circle: lourys/pterodactyl-wings-logs
| ├ :red_circle: proftpd-logs
| ├ :red_circle: schiz0phr3ne/prowlarr-logs
| ├ :red_circle: schiz0phr3ne/radarr-logs
| ├ :red_circle: schiz0phr3ne/sonarr-logs
| ├ :red_circle: timokoessler/gitlab-logs
| └ :red_circle: timokoessler/mongodb-logs
├ s02-enrich
| ├ :green_circle: crowdsecurity/dateparse-enrich (+2 ~1)
| ├ create evt.Enriched.MarshaledTime : 2022-10-29T00:06:10Z
| ├ update evt.MarshaledTime : → 2022-10-29T00:06:10Z
| ├ create evt.Meta.timestamp : 2022-10-29T00:06:10Z
| ├ :green_circle: crowdsecurity/geoip-enrich (+9)
| ├ create evt.Enriched.ASNNumber : 0
| ├ create evt.Enriched.ASNOrg :
| ├ create evt.Enriched.ASNumber : 0
| ├ create evt.Enriched.IsInEU : false
| ├ create evt.Enriched.IsoCode :
| ├ create evt.Enriched.Latitude : 0.000000
| ├ create evt.Enriched.Longitude : 0.000000
| ├ create evt.Meta.ASNNumber : 0
| ├ create evt.Meta.IsInEU : false
| ├ :red_circle: crowdsecurity/http-logs
| ├ :red_circle: crowdsecurity/naxsi-logs
| └ :green_circle: crowdsecurity/whitelists (~2 [whitelisted])
| └ update evt.Whitelisted : %!s(bool=false) → true
| └ update evt.WhitelistReason : → private ipv4/ipv6 ip/ranges
└-------- parser failure :red_circle:

And as you stated the docker image would never work as it is not syslog so that would need a custom parser most likely.

Thank you!! Now I need to find how to modify the Alpine’s default syslog … or change the parser in Crowdsec?

To avoid the parser’s problem I have installed syslog-ng in Alpine Linux. The default syslog-busybox Alpine uses prints a column more.