[syslog-ng] patterndb: collect login/logout samples

Balazs Scheidler bazsi at balabit.hu
Tue Jul 13 13:25:13 CEST 2010


Hi,

After getting the generic patterndb policy into shape, I'd like to start
collecting log samples, preferably in a domain that is useful for
everyone.

My target is at first is login/logout/login failure events. I'd start
with a generic Linux installation and try to cover all applications that
perform authentication.

As a starter, I've commited access/sshd.pdb, containing three rules for
OpenSSH login/logout/login failure events.

I'd head towards standard services, ftp, pop3 and imap authentication,
using their "default" implementation in Ubuntu/Debian. (if there's no
default, I'll just pick one at random).

If any of you can collect these 3 samples of any of the applications
that you run daily on your system and submit them here, it'd be
tremendous use and would be appreciated.

The format of the submission would be preferred in patterndb format (see
the ssh sample I've just pushed), but if you are afraid of that, even
simple samples would be useful, I'll do the markup myself.

-- 
Bazsi



More information about the syslog-ng mailing list