Mercurial > logstash

annotate sendmail.pattern @ 12:567e51f1f5e7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
better grep filter config
author Carl Byington <carl@five-ten-sg.com>
date Fri, 22 Mar 2013 15:09:21 -0700
parents 59fe08a2fcbe
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
1 # https://raw.github.com/augieschwer/grok-patterns/master/sendmail.grok
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
2 #
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
3
1
59fe08a2fcbe switch to flatjar.jar; fix sendmail patterns
Carl Byington <carl@five-ten-sg.com>
parents: 0
diff changeset
4 LOGIN [.a-zA-Z0-9_-]+
0
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
5 EMAIL %{LOGIN}@%{IPORHOST}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
6 DSN [0-9][.][0-9][.][0-9]
1
59fe08a2fcbe switch to flatjar.jar; fix sendmail patterns
Carl Byington <carl@five-ten-sg.com>
parents: 0
diff changeset
7 QID [A-za-z0-9]{14}
0
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
8
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
9 # Match a relay that gives us a QID in the return status.
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
10 SENDMAIL_TO_1 %{SYSLOGBASE} %{QID:qid}: to=<%{EMAIL:to}>, (%{WORD}=%{DATA},)+ relay=%{IPORHOST:relay} \[%{IP}\], dsn=%{DSN:dsn}, stat=%{DATA:status} \(%{QID:qid} %{GREEDYDATA:status_message}\)
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
11
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
12 # Match a relay that does NOT give us a QID in the return status.
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
13 SENDMAIL_TO_2 %{SYSLOGBASE} %{QID:qid}: to=<%{EMAIL:to}>, (%{WORD}=%{DATA},)+ relay=%{IPORHOST:relay} \[%{IP}\], dsn=%{DSN:dsn}, stat=%{DATA:status} \(%{GREEDYDATA:status_message}\)
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
14
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
15 # Match a message with no relay IP address or status message.
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
16 SENDMAIL_TO_3 %{SYSLOGBASE} %{QID:qid}: to=<%{EMAIL:to}>, (%{WORD}=%{DATA},)+ relay=%{IPORHOST:relay}, dsn=%{DSN:dsn}, stat=%{GREEDYDATA:status}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
17
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
18 # Match a message with no relay info at all.
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
19 SENDMAIL_TO_4 %{SYSLOGBASE} %{QID:qid}: to=<%{EMAIL:to}>, (%{WORD}=%{DATA},)+ stat=%{GREEDYDATA:status}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
20
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
21 ### TODO - match multiple recipients in To: field.
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
22 #SENDMAIL_TO_5 %{SYSLOGBASE} %{QID:qid}: to=(<%{EMAIL:to}>,)+ (%{WORD}=%{DATA},)+ %{GREEDYDATA:status}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
23
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
24 SENDMAIL_TO (%{SENDMAIL_TO_1}|%{SENDMAIL_TO_2}|%{SENDMAIL_TO_3}|%{SENDMAIL_TO_4})
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
25
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
26 SENDMAIL_FROM %{SYSLOGBASE} %{QID:qid}: from=<%{EMAIL:from}>, (%{WORD}=%{DATA},)+ relay=%{IPORHOST:relay} \[%{IP}\]
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
27
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
28 SENDMAIL_OTHER_1 %{SYSLOGBASE} %{QID:qid}: %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
29 SENDMAIL_OTHER_2 %{SYSLOGBASE} STARTTLS=(client|server), relay=(\[)?%{IPORHOST:relay}(\])?%{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
30 SENDMAIL_OTHER_3 %{SYSLOGBASE} STARTTLS: %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
31 SENDMAIL_OTHER_4 %{SYSLOGBASE} ruleset=tls_server, arg1=SOFTWARE, relay=%{IPORHOST:relay}, %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
32 SENDMAIL_OTHER_5 %{SYSLOGBASE} STARTTLS=client, error: %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
33
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
34 SENDMAIL_RELAY %{SYSLOGBASE} ruleset=check_relay, arg1=(\[)?%{IPORHOST}(\])?, arg2=%{IP:ip}, relay=(\[)?%{IPORHOST:relay}(\])??%{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
35
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
36 SENDMAIL_AUTH_1 %{SYSLOGBASE} AUTH=server, relay=%{IPORHOST:relay} \[%{IP}\]( \(may be forged\))?, authid=%{LOGIN:user}(@%{IPORHOST})?, %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
37 SENDMAIL_AUTH_2 %{SYSLOGBASE} AUTH=server, relay=\[%{IP}\], authid=%{LOGIN:user}(@%{IPORHOST})?, %{GREEDYDATA:message}
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
38 SENDMAIL_AUTH (%{SENDMAIL_AUTH_1}|%{SENDMAIL_AUTH_2})
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
39
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
40 SENDMAIL_OTHER (%{SENDMAIL_OTHER_1}|%{SENDMAIL_OTHER_2}|%{SENDMAIL_OTHER_3}|%{SENDMAIL_OTHER_4}|%{SENDMAIL_OTHER_5})
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
41
df4952a2fb06 initial version
Carl Byington <carl@five-ten-sg.com>
parents:
diff changeset
42 SENDMAIL (%{SENDMAIL_TO}|%{SENDMAIL_FROM}|%{SENDMAIL_OTHER}|%{SENDMAIL_AUTH}|%{SENDMAIL_RELAY})