logs RADIUS : search and extract rows

[pascal37]

Hello,

I currently have a problem with my RADIUS logs.
I have to retrieve the name of all users whose connection was successful.
Such information can be found in two different lines of logs, but under the same number of process.

Such information can be found in two different lines of logs, but under the same number of processes. I have isolated the corresponding lines and I try to delete the rows for which the process number appears only once.

How?
thank you

Here is an example and my current research:

The search :

pam_radius_auth (Got user name) OR (authentication succeeded) | transaction pid

The result :

<39>Sep 15 16:44:09 bpwacs01v sshd[21657]: pam_radius_auth: Got user name reference

<39>Sep 15 16:43:59 bpwacs01v sshd[21646]: pam_radius_auth: Got user name root

<39>Sep 13 15:41:45 bpwacs01v sshd[12980]: pam_radius_auth: Got user name a102111
<39>Sep 13 15:41:47 bpwacs01v sshd[12980]: pam_radius_auth: authentication succeeded

<39>Sep 13 15:31:17 bpwacs01v sshd[25640]: pam_radius_auth: Got user name a102111
<39>Sep 13 15:31:20 bpwacs01v sshd[25640]: pam_radius_auth: authentication succeeded

I would like for exmple delete the line of my research process numbers 21657 and 21646

Thank you in advance for your advice

[vlapeintuit]

its kinda dirty but you could try something like "pam_radius_auth (Got user name) OR (authentication succeeded) | rex_ field=_raw "sshd[(?[^]])]:\spam_radius_auth: Got user name\s(?\S)" | rex field=_raw "sshd[(?[^]]*)]:\spam_radius_auth:\s(?authentication succeeded)" | stats count by pid,username,success | where success > 1

This should produce a table showing:
pid username success count
12980 a102111 authentication succeeded 2

you can also key off of authentication failed for a listing of bad auth. I use something similar to produce daily reports of failed auth in a 24 hour period and rt searches for counts above X for alerting.

Hope this helps.