Hello everybody,
I was testing Crowdsec in several syslog-based files to watch ssh logins. I have used the command cscli explain -f XXXX --failures -t syslog with the official Crowdsec docker image and I have found that, in spite of the fact that syslog parser is working in my first test, the sshd-logs parser is not acting adequately.
Firstly, an example working correctly extracted from a Debian-based-distro’s /var/log/auth.log:
Oct 29 00:37:56 bananapipro sshd[23082]: Failed password for nicux from XX.XX.XX.XX port 45874 ssh2
The aforementioned cscli command prints nothing (no failures).
In contrast, when I use an Alpine LInux’s /var/log/messages.log the sshd-logs parser fails and, therefore, cscli prints:
line: Oct 29 00:06:10 rpi auth.info sshd[26197]: Failed password for nicux from XX.XX.XX.XX port 45866 ssh2
├ s00-raw
| ├ 
crowdsecurity/docker-logs
| └ 
crowdsecurity/syslog-logs (first_parser)
├ s01-parse
| ├ crowdsecurity/sshd-logs
| └ crowdsecurity/traefik-logs
└-------- parser failure
On the other hand, my third test was with a Docker image from linuxserver.io (linuxserver/openssh-server - LinuxServer.io). In this case, they do not use syslog exactly, but s6-log, and the s00 parsers fail, as expected:
line: 2022-10-26 23:43:54.665316842 Connection closed by authenticating user nicux XX.XX.XX.XX port 45826 [preauth]
├ s00-raw
| ├ crowdsecurity/docker-logs
| ├ crowdsecurity/non-syslog
| └ crowdsecurity/syslog-logs
└-------- parser failure
I was checking the syslog parser syntax in https://docs.crowdsec.net/docs/parsers/patterns/ and I wonder if TIMESTAMP_ISO8601 pattern should work with this text and why the parser is not working exactly.
I am a newbie with respect to write/modify the Crowdsec’s parsers and I don’t know if somebody is interested in including these cases in the parsers.