How to create a custom dashboard to monitor syslog messages

The EventSentry dashboard includes the generic "Search" tile, which can be used to display data from any page in the web reports, e.g. syslog data. The Search tile also offers the ability to extract select data (strings) from events and display them in custom columns. This method can be applied to any type of event logged to the event log. This article covers how to create a custom dashboard tile in the Web Reports for monitoring real-time syslog messages. As an example, we'll set up monitoring for failed login attempts on a pfSense firewall.

Prerequisites

Syslog messages must be ingested into the EventSentry database and searchable through the Web Reports.

Steps

1. Identify the syslog message for the event you wish to monitor

Below is an example message that captures failed login attempts on the pfSense web UI:
Aug 10 13:52:26 php-fpm[978]: /index.php: webConfigurator authentication error for user 'user' from: 172.16.0.101

Since this is the raw message, we first need to create a search query that targets its common values. For example:
message:*php-fpm* AND "*webConfigurator authentication error for user*"

2. Use the Regex Formatter option to customize fields

Once your query successfully returns only the desired results, use the regex formatter option within the Web Reports to create custom columns. You can use an online regex tool to map the common fields to individual columns, in this example, we'll extract the User and Source IP:

Group Headers: User,Source IP
Regex Formatter: php-fpm\[\d+\]:\s+\S+:\s+webConfigurator authentication error for user '([^']+)' from:\s+([\d.]+)

You can test this regex expression using the Columns option within the Web Reports syslog search for that specific query:

3. Create the custom tile in the dashboard

Create a custom tile to display real-time syslogs via a syslog search query, then customize the columns based on the message format using a regex formatter. To do this:

Navigate to the desired dashboard and click the green plus icon to open the tile selection dialog.
Select the Search tile.
Position the tile and click its gear icon to edit its properties.
Fill out the fields as follows:

Type: syslog
Query: The syslog query to search
Regex formatter: Message + the regex statement
Group Headers: Columns matching the regex statement

In the example below, you can see how this is configured to display pfSense web UI authentication messages: