crowdsecurity
a1ad/mikrotik-logs : failed auth not parsed on ROS 7.9
@a1ad
Seems that the new format to display failed auth is now as follow: denied winbox/dude connect from XXX.XXX.XXX.XXX
Ok, after more tests, both the orignal synthax and the one in first post are used at the same time... The "denied winbox/dude" is when a connection attempt is made from an incompatible client. That could be an interesting addition.
@VA2XJM it will help @a1ad and ourselves if you post the text content of the log lines (rather than an image) as then we can copy and paste it into tests plus see what the issue may be.
@LaurenceJJones See in the OP, I pasted a log line inside an inline code. This is exactly it. :)
So that is the full log line? cause from image we can see a date and warning?
No, that is not a syslog line. You need to connect the Tik to a remote syslog server.
I will check next time I am on location (no remote access), I'm relaying the info only, but the owner says this is the complete line in the log file (rsyslogd dump to a fil so Crowdsec can read it).
I'll get back to you sometime next week.