TA_Linux_secure not parsing out "src" field for Failed password for invalid user

[kmarciniak]

PROBLEM: The field "src" is not parsed out for the "Failed password for invalid user" events but "src" is parsed out for the two PAM messages with rhost. If I do a failed login from a valid user account ie "Failed password for xxxxx" then "src" is parsed correctly but there are also no PAM messages with that event with any rhost fields so it seems to work correctly.

Below is a log sample for failed password for invalid user where the src is not parsed at all when PAM messages are also involved in the total login attempt.

Apr 9 14:43:48 test-backup sshd[16780]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.224.24 << src is parsed
Apr 9 14:43:48 test-backup sshd[16780]: Failed password for invalid user april9 from 192.168.224.24 port 36392 ssh2 <

[kmarciniak · Accepted solution]

Nevermind, i found a duplicate on this https://answers.splunk.com/answers/523160/confusing-behaviour-of-fieldalias.html. In my case its not 100% only the first log message get the src for a failed password log but now I know fieldalias run in parallel and no dependencies allow.