enhancement: Update previous auth worker line also

crowdsecurity · Dec 31, 2024 · 03fb6a0 · 03fb6a0
1 parent 07016e4
commit 03fb6a0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/parsers/s01-parse/crowdsecurity/dovecot-logs.yaml b/parsers/s01-parse/crowdsecurity/dovecot-logs.yaml
@@ -11,7 +11,7 @@ nodes:
       pattern: "%{WORD:protocol}-login: %{DATA:dovecot_login_message}: user=<%{DATA:dovecot_user}>.*, rip=%{IP:dovecot_remote_ip}, lip=%{IP:dovecot_local_ip}"
       apply_on: message
   - grok:
-      pattern: "auth-worker\\(%{INT}\\): %{WORD:dovecot_user_backend}\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip},?%{DATA}\\): (%{DATA}: )?%{DATA:dovecot_login_message}$"
+      pattern: "auth-worker\\(%{INT}\\): %{WORD:dovecot_user_backend}\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip},?%{DATA}\\): (%{AUTH_WORKER_FUNC} failed: )?%{DATA:dovecot_login_message}$"
       apply_on: message
   - grok:
       pattern: "auth-worker\\(%{INT}\\): (Info: )?conn unix:auth-worker \\(pid=%{INT},uid=%{INT}\\): auth-worker<%{INT}>: %{WORD:dovecot_user_backend}\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip},?%{DATA}\\): (%{AUTH_WORKER_FUNC:auth_worker_func} failed: )?%{DATA:dovecot_login_message}$"