Grok for auth.log

Graylog Central (peer support)
1

Hello,
does someone someone have a complete GROK to parse the auth.log?

2

Which auth.log do you mean, please be more specific.

3

on debian-(based)-systems /var/log/auth.log

4

Maybe you can use filebeat as a example:

1 Like
5

ok thanks… I’ll try that…
but its sad that graylog doesn’t have standard build-in things… (like auth.log, apache-access/error.log, etc… )

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.