On Tue, Jul 17, 2012 at 4:44 PM, Gil Vidals <[email protected]> wrote: > I'm struggling trying to find a format for proftp logs that will be > compatible with OSSEC. Can anyone help me in defining the log format that > will work? > > My server's log file seems to be incompatible: > > /var/log/proftpd/current > @400000005005a3de304eb10c 207.158.10.18 > (::ffff:108.216.105.169[::ffff:108.216.105.169]) - USER schuyler (Login > failed): Incorrect password. > @400000005005a3d929323614 207.158.10.18 > (::ffff:108.216.105.169[::ffff:108.216.105.169]) - USER schuyler (Login > failed): Incorrect password. > @400000005005a3d21ee51884 207.158.10.18 > (::ffff:108.216.105.169[::ffff:108.216.105.169]) - USER schuyler (Login > failed): Incorrect password. > @400000005005a40a2bbf64ec 207.158.10.18 > (::ffff:108.216.105.169[::ffff:108.216.105.169]) - USER schuyler (Login > failed): Incorrect password. > > > > -- > Gil Vidals > > CONFIDENTIALITY NOTICE: The information contained in this transmission may > contain privileged and confidential information. It is intended only for > the use of the person(s) named above. If you are not the intended > recipient, please contact the sender by reply email and permanently delete > the original message. >
This is what seems to be expected: <!-- ProFTPD decoder. - Will extract the username/srcip - Examples: - proftpd[26916]: hayaletgemi (85.101.218.135[85.101.218.135]) - ANON anonymous: Login successful. - proftpd[12564]: juf01 (pD9EE35B1.dip.t-dialin.net[217.238.53.177]) - USER jufu: Login successful - proftpd[30362] xx.yy.zz (aa.bb.cc[aa.bb.vv.dd]): USER backup: Login successful. - proftpd[2344]: refused connect from 192.168.1.2 (192.168.1.2) - proftpd[15181]: valhalla (crawl-66-249-66-80.googlebot.com[66.249.66.80]) - Connection from crawl-66-249-66-80.googlebot.com [66.249.66.80] denied. -->
