###################################################################### # Log Adapter | sshd2 # LA Version | 1.2.0 # Tmpl Version | 1.0 # Company | SenSage, Inc. # Date | 4-30-2007 # Update | 6-12-2021 # -------------------------------------------------------------------- # Description | This log adapter is designed to parse and load the # | transaction log files generated by the SenSage collector. ###################################################################### # Copyright © 2001-2021 SenSage, Inc. # All Rights Reserved. ###################################################################### ###################################################################### # REGEX LEGEND # (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) -- timestamp YYYY-MM-DD HH:MM:SS # ([^\s\.]+)\.([^\s\.]+) -- facility + '.' + priority # (\S+)\s+ -- hostname (rptr_host) # ([^\s\(\[:]+) -- process name (proc_name) # (?:\(([^\s\)]+)\))? -- optional process user name in parentheses # (?:\[(\d+)\])?: -- optional pid in [] , mandatory colon ':' # (.*) -- message payload msg_payload # (^$)|(.*) -- catchall for s_rawmsg | f_rawmsg # ###################################################################### #(^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) ([^\s\.]+)\.([^\s\.]+) (\S+)\s+([^\s\(\[:]+)(?:\(([^\s\)]+)\))?(?:\[(\d+)\])?:(.*)$)|(.*) (^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) ([^\s\.]+)\.([^\s\.]+) (?:[^\s]+\s\w+\[\d+\]\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[-+]\d{2}:\d{2}\s)?(\S+)\s+([^\s\(\[:]+)(?:\(([^\s\)]+)\))?(?:\[(\d+)\])?:?(.*)$)|(.*) s_rawmsg:VARCHAR,timestamp:VARCHAR,facility:VARCHAR,pri:VARCHAR,rptr_host:VARCHAR,proc_name:VARCHAR,proc_uname:VARCHAR,proc_pid:VARCHAR,msg_payload:VARCHAR,f_rawmsg:VARCHAR ------------------------------------------------------- -- Additional Log Adapter Variables ------------------------------------------------------- ------------------------------------------------------- -- Mandatory: SenSage PTL base setup -- ALL variables in the following section should exist -- in every valid SenSage PTL ------------------------------------------------------- WITH $ADAPTER_VER AS '1.1.0' -- ADAPTER VERSION WITH $TZ AS 'GMT' -- SET SERVER TIMEZONE. DEFAULT = GMT WITH $YEAR AS _timeformat("%Y",_now(),$TZ) -- dynamically calculate year --WITH $STORE_RAW_PARSE_SUCCESS AS 'Y' -- VALID OPTIONS: [Y|N] WITH $STORE_RAW_PARSE_SUCCESS AS 'Y' -- VALID OPTIONS: [Y|N] WITH $STORE_RAW_PARSE_FAILURE AS 'Y' -- VALID OPTIONS: [Y|N] WITH $APP_VENDOR AS 'StandardUnix' -- Vendor of the APP WITH $APP_NAME AS 'sshd' -- Application Name WITH $APP_VERSION AS 'n/a' -- APP VERSION ------------------------------------------------------- -- Optional: SenSage PTL extended Setup -- Variables which may be useful if needed -- NOTES: no extended setup used ------------------------------------------------------- ------------------------------------------------------- -- User_Defined Functions ------------------------------------------------------- WITH parse_message AS BUILTIN 'perl5' FUNCTION < "" THEN _timestamp(now()) ELSE _TIMESTAMP(_strptime(timestamp, "%Y-%m-%d %T", $TZ)) END as EVENT_TS, ------------------------------------------------------- -- Schema - Required Fields (PREPEND) ------------------------------------------------------- _VARCHAR($ADAPTER_VER) AS ADAPTER_VER, _VARCHAR($APP_NAME) AS APP_NAME, _VARCHAR($APP_VENDOR) AS APP_VENDOR, _VARCHAR($APP_VERSION) AS APP_VERSION, _VARCHAR($TZ) AS TIMEZONE, ------------------------------------------------------- -- Schema - Adapter Specific Fields ------------------------------------------------------- ------------------------------------------------------- -- Schema - SenSage PTL extended Setup (APPEND) -- Notes: No Extended Setup ------------------------------------------------------- -- parsed[1] --> contains return value/ AUDIT_PARSE_SUCCESS _VARCHAR(facility) AS FACILITY, _VARCHAR(pri) AS PRIORITY, _VARCHAR(proc_name) AS PROC_NAME, _VARCHAR(proc_uname) AS PROC_UNAME, _VARCHAR(proc_pid) AS PROC_PID, _VARCHAR(rptr_host) AS RPTR_HOST, _VARCHAR(parsed[2]) AS EVENT_ACTION, --- _VARCHAR(parsed[3]) AS EVENT_TYPE, --- auth|authfail|error|status|other|connect|disconnect _VARCHAR(parsed[4]) AS EVENT_INFO, --- status message accompanying EVENT_ACTION _VARCHAR(parsed[5]) AS USERNAME, --- user name _VARCHAR(parsed[6]) AS SRCHOST, --- either ipaddress or hostname or src _VARCHAR(parsed[7]) AS SRCPORT, --- source port _VARCHAR(parsed[8]) AS PROTO, --- app proto (i.e. ssh , ssh2) _VARCHAR(parsed[9]) AS KEY_FILENAME, --- if a public keyfile name is available ------------------------------------------------------- -- Schema - Required Fields (APPEND) ------------------------------------------------------- CASE WHEN f_rawmsg <> "" THEN _int64(-1) -- if there is a value in f_rawmsg then the main parsing failed -- WHEN parsed[1] <> "" AND parsed[1] <> "1" THEN _int64(-1) ELSE _int64(1) END as AUDIT_PARSE_SUCCESS, -- use the success/fail rawmsg value to unparsed_message -- do to alternation rules only one will be populated -- s_rawmsg = success -- f_rawmsg = failure CASE WHEN s_rawmsg <> "" and $STORE_RAW_PARSE_SUCCESS=="Y" THEN _varchar(s_rawmsg) WHEN f_rawmsg <> "" and $STORE_RAW_PARSE_FAILURE=="Y" THEN _varchar(f_rawmsg) ELSE _varchar("") END as unparsed_message, ------------------------------------------------------- -- Non-Schema - Adapter Required Fields -- DO NOT DELETE THESE FIELDS - required to change table schema ------------------------------------------------------- _BOOL(0) as _internal_bool, _FLOAT(0) as _internal_float, _INT32(0) as _internal_int32, _INT64(0) as _internal_int64, _TIMESTAMP(0) as _internal_timestamp, _VARCHAR('') as _internal_varchar FROM stdin;