All Apps and Add-ons

TA_Linux_secure not parsing out "src" field for Failed password for invalid user

kmarciniak
Path Finder

PROBLEM: The field "src" is not parsed out for the "Failed password for invalid user" events but "src" is parsed out for the two PAM messages with rhost. If I do a failed login from a valid user account ie "Failed password for xxxxx" then "src" is parsed correctly but there are also no PAM messages with that event with any rhost fields so it seems to work correctly.

Below is a log sample for failed password for invalid user where the src is not parsed at all when PAM messages are also involved in the total login attempt.

Apr 9 14:43:48 test-backup sshd[16780]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.224.24 << src is parsed
Apr 9 14:43:48 test-backup sshd[16780]: Failed password for invalid user april9 from 192.168.224.24 port 36392 ssh2 <

0 Karma
1 Solution

kmarciniak
Path Finder

Nevermind, i found a duplicate on this https://answers.splunk.com/answers/523160/confusing-behaviour-of-fieldalias.html. In my case its not 100% only the first log message get the src for a failed password log but now I know fieldalias run in parallel and no dependencies allow.

View solution in original post

0 Karma

kmarciniak
Path Finder

Nevermind, i found a duplicate on this https://answers.splunk.com/answers/523160/confusing-behaviour-of-fieldalias.html. In my case its not 100% only the first log message get the src for a failed password log but now I know fieldalias run in parallel and no dependencies allow.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...