How to use patterndb in syslog-ng

Question

syslog-ng.conf

https://www.balabit.com/network-security/syslog-ng/opensource-logging-system/features/pattern-db

@define logfileName "/apps/syslog-ng/etc/testing.log"
@define Pattern1 ".*Exception.*"

source s_app1.conf { file("`logfileName`" flags(no-parse)  follow-freq(1)); };

#Edit here below vars
#InstanceName in each template  ( need to start with $HOST.)
#EventName (as numbered ) in each template line. 
#change <first section> as required for severity.
#186 -> Critical (critical)
#187 -> Major    (error)
#188 -> Minor    (warning)

parser pattern_db {
            db_parser(
                file("/apps/syslog-ng/etc/syslog-ng-patterndb-master/applications/openssh/example.xml")
            );
            };

            parser t_app1.conf_1 {
            db_parser(
                file("/apps/syslog-ng/etc/syslog-ng-patterndb-master/applications/openssh/example.xml")
            );
            };

template t_app1.conf_1
{
    template ("<186><$ISODATE>[HostName=$HOST][ClassName=Application][InstanceName=$HOST/BoB/app2-l1][EventName=`Pattern1`][LogFileName=`logfileName`][$MSG] ${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS} \n");
    template_escape(no);
};
destination d_app1.conf_1 { syslog("10.54.20.98" transport("udp") port(514)  template(t_app1.conf_1)); };



filter f_app1.conf_1 { message("`Pattern1`" flags("utf8" "ignore-case") ); };



log { source(s_app1.conf); filter(f_app1.conf_1); destination(d_app1.conf_1); flags(final); };

my patterndb xml

example.xml

<?xml version='1.0' encoding='UTF-8'?>
<patterndb version="3" pub_date="2010-04-15">
    <ruleset name='ssh' id='123456678'>
        <pattern>ssh</pattern>
            <rules>
                <rule provider='me' id='182437592347598' class='system'>
                    <patterns>
                        <pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                    </patterns>
                    <examples>
                        <example>
                            <test_message program="ssh">Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2</test_message>
                            <test_values>
                                <test_value name="SSH.AUTH_METHOD">password</test_value>
                                <test_value name="SSH_USERNAME">sampleuser</test_value>
                                <test_value name="SSH_CLIENT_ADDRESS">10.50.0.247</test_value>
                                <test_value name="SSH_PORT_NUMBER">42156</test_value>
                            </test_values>
                       </example>
                    </examples>
                </rule>
            </rules>
    </ruleset>
</patterndb>

I am trying to use patterndb with syslog-ng by going through their offiical blog,i am able to install and use syslog but not patterndb as there is no installation guide which describes how to use patterndb.if anyone has used patterndb with syslog on linux system please guide me.

score 4 · Accepted Answer · answered Mar 21 '17 at 11:39

4

you can find information in the official documentation of syslog-ng patterndb.

Basically, you want to create a patterndb file (you can find sample patterndb files on github, and also in this blogpost), and use it in your syslog-ng configuration to parse the log messages.

Then, depending on how or what you have parsed, you can use the results in your destination template, or for filtering, or many other things.

Can you describe what and why you'd like to parse?

answered Mar 21 '17 at 11:39

Robert Fekete

557
3
5

consider i want to parse this common message "Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2" ,so for this i just need a xml file which contanins patterndb xml ? – sdvadsa Mar 21 '17 at 11:43
In patterndb, the xml file contains the rules that parse the messages. For each message you want to parse, you'll need a matching rule (one rule can match multiple different messages, depending on the messages). To parse the above SSH login message, you need only a rule for this message. You can find sample rules for SSH here: https://github.com/balabit/syslog-ng-patterndb/blob/master/applications/openssh/sshd.xml – Robert Fekete Mar 21 '17 at 12:07
hi robert ,can you check whether conf file correct or not? – sdvadsa Mar 22 '17 at 07:47
Hi, you have defined the pattern database in your config, but you are not actually using it in the log path. Try something like this): log { source(s_app1.conf); parser (t_app1.conf_1); filter(f_app1.conf_1); destination(d_app1.conf_1); flags(final); }; – Robert Fekete Mar 23 '17 at 11:17
hi robert, can you help my friend with this question http://stackoverflow.com/questions/43319887/correlation-using-patterndb-and-syslog – sdvadsa Apr 10 '17 at 09:47

How to use patterndb in syslog-ng

1 Answers1