syslog.cfg

# Alienvault plugin
# Author: Alienvault Team at devel@alienvault.com
# Plugin syslog id:4007 version: 0.0.2
# Last modification: 2015-05-13 16:11
#
# Plugin Selection Info:
# Syslog:Syslog:-
#
# END-HEADER
# Accepted products:
# syslog - syslog -
# Description:
# 
#
#

[DEFAULT]
plugin_id=4007

[config]
type=detector
enable=yes

source=log
location=/var/log/syslog

create_file=true

process=
start=no   
stop=no
startup=
shutdown=


[syslog - datamining]
event_type=event
regexp="^(?P<logline>(\SYSLOG_DATE)\s+(?P<sensor>\S+)\s+(?P<source>\S+)\s+(?P<generator>[^\[]*)\[(?P<pid>\d+)\]:(?P<logged_event>.*))$"
device={resolv($sensor)}
date={normalize_date($1)}
plugin_sid=1
src_ip={resolv($sensor)}
userdata1={md5sum($logline)}
userdata3={$generator}
userdata4={$logged_event}
userdata5={$pid}

[syslog - datamining - all]
event_type=event
regexp="^(?P<logline>(?P<date>\SYSLOG_DATE)\s+(?P<sensor>\S+)\s+(?P<source>\S+)\s+(?P<logged_event>.*)$)"
device={resolv($sensor)}
date={normalize_date($date)}
plugin_sid=1
src_ip={resolv($sensor)}
userdata1={md5sum($logline)}
userdata3={$logged_event}