Repository
Munin (contrib)
Last change
2020-10-04
Graph Categories
Family
auto
Capabilities
Keywords
Language
Shell
Authors

sshd_log

Example graph: day Example graph: month

Name

sshd_log - Munin plugin to monitor auth.log or journald for sshd server events.

Configuration

This plugin requires read permission for the logfile or journald.

On busy servers you can change value type to COUNTER and set min to 0 to avoid minus peaks at logrotate.

The following environment variables are used by this plugin:

logfile  - path to the auth log file, or "journald" to use journald.
           default: /var/log/secure

journalctlargs - space separated list of arguments to pass to
                 journalctl to get the sshd logs.
                 default: _COMM=sshd

type - "GAUGE" or "DERIVE"
        default: GAUGE

If the “logfile” environment variable is set to “journald” the sshd logs are read from journald, filtering on program “sshd”. The filtering may be changed using “journalctlargs”.

Config examples for /etc/munin/plugin-conf.d/munin-node:

[sshd_log]
    user root
    group root
    env.logfile /var/log/messages

Config example with journald:

[sshd_log]
    group systemd-journal
    env.logfile journald

Config example with journald on the sshd.service unit only:

[sshd_log]
    group systemd-journal
    env.logfile journald
    env.journalctlargs --unit=sshd.service

Config example with journald and type DERIVE:

[sshd_log]
    group systemd-journal
    env.logfile journald
    env.type DERIVE

Magic Markers

#%# family=auto
#%# capabilities=autoconf

Author

Copyright (C) 2009 zlati

Copyright (C) 2009 ckujau

Copyright (C) 2010 pmoranga

Copyright (C) 2016 Thomas Riccardi

#!/bin/sh

: <<=cut

=head1 NAME

sshd_log - Munin plugin to monitor auth.log or journald for sshd
           server events.

=head1 CONFIGURATION

This plugin requires read permission for the logfile or journald.

On busy servers you can change value type to COUNTER and set min to 0
to avoid minus peaks at logrotate.

The following environment variables are used by this plugin:

 logfile  - path to the auth log file, or "journald" to use journald.
            default: /var/log/secure

 journalctlargs - space separated list of arguments to pass to
                  journalctl to get the sshd logs.
                  default: _COMM=sshd

 type - "GAUGE" or "DERIVE"
         default: GAUGE

If the "logfile" environment variable is set to "journald" the sshd
logs are read from journald, filtering on program "sshd". The filtering
may be changed using "journalctlargs".


Config examples for /etc/munin/plugin-conf.d/munin-node:

  [sshd_log]
      user root
      group root
      env.logfile /var/log/messages

Config example with journald:

  [sshd_log]
      group systemd-journal
      env.logfile journald

Config example with journald on the sshd.service unit only:

  [sshd_log]
      group systemd-journal
      env.logfile journald
      env.journalctlargs --unit=sshd.service

Config example with journald and type DERIVE:

  [sshd_log]
      group systemd-journal
      env.logfile journald
      env.type DERIVE

=head1 MAGIC MARKERS

  #%# family=auto
  #%# capabilities=autoconf

=head1 AUTHOR

Copyright (C) 2009 zlati

Copyright (C) 2009 ckujau

Copyright (C) 2010 pmoranga

Copyright (C) 2016 Thomas Riccardi

=cut


# Script parameters:
#
#       config   (required)
#       autoconf (optional - used by munin-config)


LOG=${logfile:-/var/log/secure}
JOURNALCTL_ARGS=${journalctlargs:-_COMM=sshd}
TYPE=${type:-GAUGE}
if [ "$LOG" = "journald" -a "$TYPE" = "DERIVE" ]; then
        TYPE=ABSOLUTE
fi


if [ "$1" = "autoconf" ]; then
        if [ "$LOG" = "journald" ]; then
                # shellcheck disable=SC2086,SC2034
                if journalctl --no-pager --quiet --lines=1 $JOURNALCTL_ARGS | read -r DUMMY; then
                        echo "yes"
                else
                        echo "no (journald empty log for '$JOURNALCTL_ARGS' not found)"
                fi
        else
                if [ -r "$LOG" ]; then
                        echo "yes"
                else
                        echo "no (logfile '$LOG' not readable)"
                fi
        fi
        exit 0
fi

if [ "$1" = "config" ]; then
        echo 'graph_title SSHD login stats'
        echo 'graph_info SSHD login stats from' "$LOG"
        echo 'graph_args --base 1000 -l 0'
        echo 'graph_vlabel logins'
        echo 'graph_category' security

        echo 'LogPass.label Successful password logins'
        echo 'LogPass.min 0'
        echo 'LogPass.type' "$TYPE"

        echo 'LogPassPAM.label Successful login via PAM'
        echo 'LogPassPAM.min 0'
        echo 'LogPassPAM.type' "$TYPE"

        echo 'LogKey.label Successful PublicKey logins'
        echo 'LogKey.min 0'
        echo 'LogKey.type' "$TYPE"

        echo 'NoID.label No identification from user'
        echo 'NoID.min 0'
        echo 'NoID.type' "$TYPE"

        echo 'rootAttempt.label Root login attempts'
        echo 'rootAttempt.min 0'
        echo 'rootAttempt.type' "$TYPE"

        echo 'InvUsr.label Invalid user login attempts'
        echo 'InvUsr.min 0'
        echo 'InvUsr.type' "$TYPE"

        echo 'NoRDNS.label No reverse DNS for peer'
        echo 'NoRDNS.min 0'
        echo 'NoRDNS.type' "$TYPE"

        echo 'Breakin.label Potential Breakin Attempts'
        echo 'Breakin.min 0'
        echo 'Breakin.type' "$TYPE"

        exit 0
fi

if [ "$LOG" = "journald" -a "$TYPE" = "ABSOLUTE" ]; then
        CURSOR_FILE="$MUNIN_STATEFILE"
        # read cursor
        # format: "journald-cursor <cursor>"
        CURSOR=
        if [ -f "$CURSOR_FILE" ]; then
                CURSOR=$(awk '/^journald-cursor / {print $2}' "$CURSOR_FILE")
        fi
else
        CURSOR_FILE=
fi

if [ "$LOG" = "journald" ]; then
        # shellcheck disable=SC2086
        if [ "$TYPE" = "ABSOLUTE" ]; then
                journalctl --no-pager --quiet --show-cursor ${CURSOR:+"--after-cursor=$CURSOR"} $JOURNALCTL_ARGS
        else
                journalctl --no-pager --quiet --since=$(date -dlast-sunday +%Y-%m-%d) $JOURNALCTL_ARGS
        fi
else
        cat "$LOG"
fi | \
    awk -v cursor_file="$CURSOR_FILE" 'BEGIN{c["LogPass"]=0;c["LogKey"]=0;c["NoID"]=0;c["rootAttempt"]=0;c["InvUsr"]=0;c["LogPassPAM"]=0;c["Breakin"]=0;c["NoRDNS"]=0; }
     /sshd\[.*Accepted password for/{c["LogPass"]++}
     /sshd\[.*Accepted publickey for/{c["LogKey"]++}
     /sshd\[.*Did not receive identification string/{c["NoID"]++}
     /sshd\[.*Failed password for root/{c["rootAttempt"]++}
     /sshd\[.*Invalid user/{c["InvUsr"]++}
     /sshd\[.*POSSIBLE BREAK-IN ATTEMPT!/{c["Breakin"]++}
     /sshd\[.*keyboard-interactive\/pam/{c["LogPassPAM"]++}
     /sshd\[.*reverse mapping checking getaddrinfo/{c["NoRDNS"]++}a
     END{if (cursor_file != "") { print "journald-cursor " $3 > cursor_file };for(i in c){print i".value " c[i]} }'