# Install:
#   tail plugin comes with collectd

# Documentation:
#   https://collectd.org/wiki/index.php/Plugin:Tail
# 
# Metrics collected with important dimensions:
#  counter.errors 
#    dims: instance=[kernel|syslog]
#  counter.sshd  
#    dims: invalid=[user|password]

# System modifications:
#   None

# Config file modifications:
#   Depending on your system configuration you may want to change syslog to 
#   messages, or auth.log to secure, etc.

LoadPlugin tail
<Plugin "tail">
  <File "/var/log/kern.log">
    Instance "kernel"
    <Match>
      Regex "------------[ cut here ]------------"
      DSType "CounterInc"
      Type "counter"
      Instance "errors"
    </Match>
  </File>
  <File "/var/log/syslog">
    Instance "syslog"
    <Match>
      Regex "error|ERROR|fail|FAIL"
      ExcludeRegex "rsyslogd-pstats"
      DSType "CounterInc"
      Type "counter"
      Instance "errors"
    </Match>
  </File>
  <File "/var/log/auth.log">
    Instance "auth"
    <Match>
      Regex "\\<sshd[^:]*: Invalid user [^ ]+ from\\>"
      DSType "CounterInc"
      Type "counter"
      Instance "sshd[invalid=user]"
    </Match>
    <Match>
      Regex "\\<sshd[^:]*: Failed password for [^ ]+ from\\>"
      DSType "CounterInc"
      Type "counter"
      Instance "sshd[invalid=password]"
    </Match>
  </File>
</Plugin>
