All Apps and Add-ons

TA_Linux_secure not parsing out "src" field for Failed password for invalid user

Path Finder

PROBLEM: The field "src" is not parsed out for the "Failed password for invalid user" events but "src" is parsed out for the two PAM messages with rhost. If I do a failed login from a valid user account ie "Failed password for xxxxx" then "src" is parsed correctly but there are also no PAM messages with that event with any rhost fields so it seems to work correctly.

Below is a log sample for failed password for invalid user where the src is not parsed at all when PAM messages are also involved in the total login attempt.

Apr 9 14:43:48 test-backup sshd[16780]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.224.24 << src is parsed
Apr 9 14:43:48 test-backup sshd[16780]: Failed password for invalid user april9 from 192.168.224.24 port 36392 ssh2 <

0 Karma
1 Solution

Path Finder

Nevermind, i found a duplicate on this https://answers.splunk.com/answers/523160/confusing-behaviour-of-fieldalias.html. In my case its not 100% only the first log message get the src for a failed password log but now I know fieldalias run in parallel and no dependencies allow.

View solution in original post

0 Karma

Path Finder

Nevermind, i found a duplicate on this https://answers.splunk.com/answers/523160/confusing-behaviour-of-fieldalias.html. In my case its not 100% only the first log message get the src for a failed password log but now I know fieldalias run in parallel and no dependencies allow.

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!