Update patterns

Dh0mp5eur · Dec 19, 2014 · ba45fd2 · ba45fd2
1 parent db6f3ed
commit ba45fd2
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 9 deletions.
diff --git a/test/action_0001.yaml b/test/action_0001.yaml
@@ -1,4 +1,4 @@
-pattern: VSFTPD
+pattern: VSFTPD_ACTION
 data: "[newuser] OK LOGIN: Client \"192.168.1.1\""
 result:
         vsftpd_user: newuser

diff --git a/test/action_0002.yaml b/test/action_0002.yaml
@@ -1,4 +1,4 @@
-pattern: VSFTPD
+pattern: VSFTPD_ACTION
 data: "[newuser] OK UPLOAD: Client \"192.168.1.1\", \"/transfert.ACK\", 7 bytes, 0.17Kbyte/sec"
 result:
         vsftpd_user: newuser

diff --git a/test/action_0003.yaml b/test/action_0003.yaml
@@ -1,4 +1,4 @@
-pattern: VSFTPD
+pattern: VSFTPD_ACTION
 data: "[newuser] FAIL LOGIN: Client \"192.168.1.1\""
 result:
         vsftpd_user: newuser

diff --git a/test/action_0004.yaml b/test/action_0004.yaml
@@ -0,0 +1,9 @@
+pattern: VSFTPD_ACTION
+data: "[newuser] FAIL DOWNLOAD: Client \"192.168.1.1\", \"/transfert.ACK\", 0.00Kbyte/sec"
+result:
+        vsftpd_user: newuser
+        vsftpd_action_status: FAIL
+        vsftpd_action: DOWNLOAD
+        vsftpd_client_ip: 192.168.1.1
+        vsftpd_file: "/transfert.ACK"
+        vsftpd_file_transfer_speed: "0.00Kbyte/sec"
diff --git a/test/connect_0001.yaml b/test/connect_0001.yaml
@@ -1,4 +1,5 @@
-pattern: VSFTPD
+pattern: VSFTPD_CONNECT
 data: "CONNECT: Client \"192.168.1.1\""
 result:
+        vsftpd_action: CONNECT
         vsftpd_client_ip: 192.168.1.1
diff --git a/vsftpd.grok b/vsftpd.grok
@@ -1,6 +1,3 @@
 # common vsftpd patterns
-VSFTPD_CONNECT CONNECT: Client \"%{IP:vsftpd_client_ip}\"
-VSFTPD_ACTION \[%{WORD:vsftpd_user}\] %{WORD:vsftpd_action_status} %{WORD:vsftpd_action}: Client \"%{IP:vsftpd_client_ip}\"(, \"%{GREEDYDATA:vsftpd_file}\", %{DATA:vsftpd_file_size}, %{DATA:vsftpd_file_transfer_speed}$|)
-
-# aggregate all patterns
-VSFTPD %{VSFTPD_CONNECT}|%{VSFTPD_ACTION}
+VSFTPD_CONNECT %{WORD:vsftpd_action}: Client \"%{IP:vsftpd_client_ip}\"
+VSFTPD_ACTION \[%{WORD:vsftpd_user}\] %{WORD:vsftpd_action_status} %{WORD:vsftpd_action}: Client \"%{IP:vsftpd_client_ip}\"(, \"%{GREEDYDATA:vsftpd_file}\", %{DATA:vsftpd_file_size}, %{DATA:vsftpd_file_transfer_speed}|, \"%{GREEDYDATA:vsftpd_file}\", %{DATA:vsftpd_file_transfer_speed}|)$