topic Re: Is this the correct way to extract successful and failed logins from /var/log/secure in a search? in Splunk Search

Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

sureshsala — Tue, 19 Apr 2016 14:02:30 GMT

I need help with the regular expression for field extraction of login status:

Successful:

source="/var/log/secure" | rex field=_raw " user (?[^ ]+)"| search user="*" | chart count BY host,user

Failed:

source="/var/log/secure" | rex field=_raw " invalid user (?[^ ]+)"| search user="*" | chart count BY host,user

Is this the right way to do it, or there is a better way?

Please help.

Re: Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

sundareshr — Tue, 19 Apr 2016 18:18:09 GMT

What does the log entry look like? Can you share one event with successful logon and one with failed logon?

Re: Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

somesoni2 — Tue, 19 Apr 2016 18:44:46 GMT

Assuming your regex is correctly extracting the users, I would try like this (I would always throw the index and sourcetype as well)

Successfull

index=yourIndex sourcetype=yourSourcetype source="/var/log/secure" "session opened for user " | rex field=_raw "session opened for user (?<user>[^ ]+)"  | chart count BY host,user

Failed

index=yourIndex sourcetype=yourSourcetype  source="/var/log/secure" fail OR invalid | rex field=_raw " invalid user (?<user>[^ ]+)" | chart count BY host,user

Re: Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

sureshsala — Wed, 20 Apr 2016 07:13:51 GMT

@somesoni2 Awesome, thanks a lot but failed regex is added NULL user and I am unable to figure out.

Re: Is this the correct way to extract successful and failed logins from /var/log/secure in a search?

sureshsala — Wed, 20 Apr 2016 08:01:16 GMT

Answer:

source="/var/log/secure" input_userauth_request AND (fail OR invalid) | rex field=_raw " invalid user (?[^ ]+)" | chart count BY host,user