diff --git a/logparser/parser_test.go b/logparser/parser_test.go index a814616..0f60dd2 100644 --- a/logparser/parser_test.go +++ b/logparser/parser_test.go @@ -40,6 +40,18 @@ var expected = map[int]map[string]string{ "username": "a.min", "src": "185.56.8.191", }, + 5: map[string]string{ + "date": "Jan 22 11:29:16", + "host": "sigmund", + "username": " ", + "src": "185.56.8.191", + }, + 6: map[string]string{ + "date": "Jan 22 11:29:16", + "host": "sigmund", + "username": "", + "src": "185.56.8.191", + }, } func TestSshdParser(t *testing.T) { @@ -53,7 +65,7 @@ func TestSshdParser(t *testing.T) { scanner := bufio.NewScanner(f) c := 0 for scanner.Scan() { - re := regexp.MustCompile(`^(?P[[:alpha:]]{3}\s\d{2}\s\d{2}:\d{2}:\d{2}) (?P[^ ]+) sshd\[[[:alnum:]]+\]: Invalid user (?P[^ ]+) from (?P.*$)`) + re := regexp.MustCompile(`^(?P[[:alpha:]]{3}\s\d{2}\s\d{2}:\d{2}:\d{2}) (?P[^ ]+) sshd\[[[:alnum:]]+\]: Invalid user (?P.*) from (?P.*$)`) n1 := re.SubexpNames() r2 := re.FindAllStringSubmatch(scanner.Text(), -1)[0] diff --git a/logparser/sshd.go b/logparser/sshd.go index 5fd529a..9a02edc 100644 --- a/logparser/sshd.go +++ b/logparser/sshd.go @@ -33,7 +33,7 @@ func (s *SshdParser) Set(rconn1 *redis.Conn, rconn2 *redis.Conn) { // Parse parses a line of sshd log func (s *SshdParser) Parse(logline string) error { r := *s.r1 - re := regexp.MustCompile(`^(?P[[:alpha:]]{3}\s\d{2}\s\d{2}:\d{2}:\d{2}) (?P[^ ]+) sshd\[[[:alnum:]]+\]: Invalid user (?P[^ ]+) from (?P.*$)`) + re := regexp.MustCompile(`^(?P[[:alpha:]]{3}\s\d{2}\s\d{2}:\d{2}:\d{2}) (?P[^ ]+) sshd\[[[:alnum:]]+\]: Invalid user (?P.*) from (?P.*$)`) n1 := re.SubexpNames() r2 := re.FindAllStringSubmatch(logline, -1)[0] diff --git a/logparser/test.log b/logparser/test.log index eea75fd..c6cab41 100644 --- a/logparser/test.log +++ b/logparser/test.log @@ -3,3 +3,5 @@ Jan 22 11:37:19 si.mund sshd[26143]: Invalid user gestion from 159.89.153.54 Jan 22 11:34:46 sigmund sshd[26125]: Invalid user atpco from 177.152.124.21 Jan 22 11:33:07 sigmund sshd[26109]: Invalid user ki from 49.233.183.158 Jan 22 11:29:16 sigmund sshd[26091]: Invalid user a.min from 185.56.8.191 +Jan 22 11:29:16 sigmund sshd[26091]: Invalid user from 185.56.8.191 +Jan 22 11:29:16 sigmund sshd[26091]: Invalid user from 185.56.8.191 \ No newline at end of file