2

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here.

In my scenario, I have one rsyslog server working with mysql and a custom template written which take logs, filter them and write them to mysql database

My tmeplate is :

$template db_k,"insert into  
sensitive_logs(ID,TIME,message) 
values('%HOSTNAME%','%timegenerated:::date-mysql%','%msg%' )", sql

Output:

Security | 20140401182028  |  Failed password for root from 192.168.1.113 port 34290 ssh2 

I'd like to extract some words from the %msg%

Example:

Failed,root,IP 

from this message part

How can I do this?

  • it really depends what type of logs you get, if it's only for bad looging with ssh, you could use the word order to extract data, if you have several message, then there's no magic trick, you will have to parse each message depending of it's structure. – Kiwy Apr 2 '14 at 10:45
  • A little googling and this presents.. Any help? rsyslog.com/regex – mikeserv Apr 2 '14 at 11:51
  • @Kiwy This is just a sample, i have to configure this for large scale of different different types of log – Security Beast Apr 2 '14 at 13:04
  • rsyslog regexp seems to be the perfect match @SecurityBeast – Kiwy Apr 2 '14 at 13:05
  • @Kiwy ya i m trying hard to grep some words from it but not getting exactly how to use that i just want to grep ip , accepted,or failed,user name. – Security Beast Apr 2 '14 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.