The current eventtype Failed_SU creates a large number of false positives for logs coming from /var/adm/sulog. The logs will always have a - between the src_user and the user. This is being picked up by the eventtype. To correct this, there needs to be spaces before and after the - between the quotes.
Current:
[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU "-") OR ("BAD SU ")
Updated:
[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")
Also, the following could be used for the log messages field extractions and then update the nix_vendor_actions lookup table with:
+, success
-, failure
I use the following for the them as a transform extraction
[aix_su]
REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5
... View more