map.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">

<properties>

<entry key="packageName"><![CDATA[linux 操作系统用户登入信息规则(syslog)]]></entry>
<entry key="packageVendor">linux</entry>
<entry key="packageModel">OS-login</entry>

<entry key="mapperCount">3</entry>
<entry key="mapper[0].sample"><![CDATA[<85>login: LOGIN ON pts/3 BY hoisan FROM hoisan214]]></entry>
<entry key="mapper[0].enable">true</entry>
<entry key="mapper[0].name"><![CDATA[登入信息]]></entry>
<entry key="mapper[0].pattern"><![CDATA[((<\d+>)|(\S+\s*\d{1,2}\s*\d{1,2}:\d{1,2}:\d{1,2}\s*\d{4}))\s*(login):\s*(.+)]]></entry>
<entry key="mapper[0].recognize"><![CDATA[((<\d+>)|(\S+\s*\d{1,2}\s*\d{1,2}:\d{1,2}:\d{1,2}\s*\d{4}))\s*(login):\s*(.+)]]></entry>

<entry key="mapper[0].fieldCount">10</entry>
<entry key="mapper[0].field[0]">deviceCat</entry>
<entry key="mapper[0].field[0].value">/OperatingSystem</entry>
<entry key="mapper[0].field[1]">catObject</entry>
<entry key="mapper[0].field[1].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].field[2]">catTechnique</entry>
<entry key="mapper[0].field[2].value">/UNKNOW</entry>
<entry key="mapper[0].field[3]">catBehavior</entry>
<entry key="mapper[0].field[3].value">/Authentication/Verify</entry>
<entry key="mapper[0].field[4]">catOutcome</entry>
<entry key="mapper[0].field[4].value">Attempt</entry>
<entry key="mapper[0].field[5]">name</entry>
<entry key="mapper[0].field[5].value"><![CDATA[登录信息]]></entry>
<entry key="mapper[0].field[6]">message</entry>
<entry key="mapper[0].field[6].value"><![CDATA[$5]]></entry>
<entry key="mapper[0].field[7]">destProcessName</entry>
<entry key="mapper[0].field[7].value">$4</entry>
<entry key="mapper[0].field[8]">a</entry>
<entry key="mapper[0].field[8].value">$1</entry>
<entry key="mapper[0].field[9]">b</entry>
<entry key="mapper[0].field[9].value">$5</entry>

<entry key="mapper[0].subMapperCount">2</entry>
<entry key="mapper[0].subMapper[0].condition">$1</entry>
<entry key="mapper[0].subMapper[0].mapperCount">2</entry>

<entry key="mapper[0].subMapper[0].mapper[0].source">${a}</entry>
<entry key="mapper[0].subMapper[0].mapper[0].sample"><![CDATA[<85>login: LOGIN ON pts/3 BY hoisan FROM hoisan214]]></entry>
<entry key="mapper[0].subMapper[0].mapper[0].name"><![CDATA[定义事件时间]]></entry>
<entry key="mapper[0].subMapper[0].mapper[0].pattern"><![CDATA[<\d+>]]></entry>
<entry key="mapper[0].subMapper[0].mapper[0].fieldCount">3</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[0]">deviceReceiptTime</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[0].value">${collectorReceiptTime}</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[1]">startTime</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[1].value">${collectorReceiptTime}</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[2]">endTime</entry>
<entry key="mapper[0].subMapper[0].mapper[0].field[2].value">${collectorReceiptTime}</entry>

<entry key="mapper[0].subMapper[0].mapper[1].source">${a}</entry>
<entry key="mapper[0].subMapper[0].mapper[1].sample"><![CDATA[May 27 00:21:25 2010 login: LOGIN ON pts/3 BY hoisan FROM hoisan214]]></entry>
<entry key="mapper[0].subMapper[0].mapper[1].name"><![CDATA[定义事件时间]]></entry>
<entry key="mapper[0].subMapper[0].mapper[1].pattern"><![CDATA[(\S+\s*\d{1,2}\s*\d{1,2}:\d{1,2}:\d{1,2}\s*\d{4})]]></entry>
<entry key="mapper[0].subMapper[0].mapper[1].fieldCount">3</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0]">deviceReceiptTime</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0].value">$1</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0].type">Timestamp</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0].format">MMM dd HH:mm:ss yyyy</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0].locale">en</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[1]">startTime</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[1].value">${deviceReceiptTime}</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[0]">endTime</entry>
<entry key="mapper[0].subMapper[0].mapper[1].field[2].value">${deviceReceiptTime}</entry>

<entry key="mapper[0].subMapper[1].condition">$4</entry>
<entry key="mapper[0].subMapper[1].mapperCount">15</entry>

<entry key="mapper[0].subMapper[1].mapper[0].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[0].sample"><![CDATA[May 27 00:21:25 2010 login: LOGIN ON pts/3 BY hoisan FROM 192.168.40.100]]></entry>
<entry key="mapper[0].subMapper[1].mapper[0].name"><![CDATA[登录成功]]></entry>
<entry key="mapper[0].subMapper[1].mapper[0].pattern"><![CDATA[LOGIN ON (\S+) BY (\S+) FROM (([\d\.]+)|(\S+))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[0].fieldCount">11</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[0].value"><![CDATA[Login On]]></entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[1].value"><![CDATA[$2 User succeeded logged on $1 from $3.]]></entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[6].value">OK</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[7].value">0</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[8]">srcUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[8].value">$2</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[9]">srcHostName</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[9].value">$3</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[10]">srcAddress</entry>
<entry key="mapper[0].subMapper[1].mapper[0].field[10].value">$4</entry>

<entry key="mapper[0].subMapper[1].mapper[1].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[1].sample"><![CDATA[<85>login: FAILED LOGIN 3 FROM hoisan214 FOR root, User not known to the underlying authentication module]]></entry>
<entry key="mapper[0].subMapper[1].mapper[1].name"><![CDATA[登录失败]]></entry>
<entry key="mapper[0].subMapper[1].mapper[1].pattern"><![CDATA[(FAILED LOGIN (\S+) FROM (([\d\.]+)|(\S+)) FOR (\S*)\s*, User not known to the underlying authentication module)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[1].fieldCount">12</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[0].value"><![CDATA[Login Failed]]></entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[1].value"><![CDATA[$6 User failed login $2 from $3,user not known to the underlying authentication module]]></entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[7].value">3</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[8].value">$6</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[9]">srcHostName</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[9].value">$3</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[10]">srcAddress</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[10].value">$4</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[11]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[1].field[11].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[2].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[2].sample"><![CDATA[<85>login: FAILED LOGIN SESSION FROM hoisan214 FOR admin, Authentication failure]]></entry>
<entry key="mapper[0].subMapper[1].mapper[2].name"><![CDATA[登录验证失败]]></entry>
<entry key="mapper[0].subMapper[1].mapper[2].pattern"><![CDATA[(FAILED LOGIN (\S+) FROM (([\d\.]+)|(\S+)) FOR (\S*)\s*, Authentication failure)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[2].fieldCount">12</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[0].value"><![CDATA[Login Authentication Failure]]></entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[1].value"><![CDATA[$6 User failed login $2 from $3,Authentication failure]]></entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[7].value">3</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[8].value">$6</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[9]">srcHostName</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[9].value">$3</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[11]">srcAddress</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[10].value">$4</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[11]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[2].field[11].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[3].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[3].sample"><![CDATA[<86>login: pam_unix(remote:session): session opened for user ben by (uid=0)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[3].name"><![CDATA[login授权信息：会话打开]]></entry>
<entry key="mapper[0].subMapper[1].mapper[3].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (session opened for user (\S+) by (\S*)\s*\(uid=(\d+)\))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[3].fieldCount">11</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[0].value"><![CDATA[login: $2 Session opened]]></entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[1].value"><![CDATA[login：$2 session,session opened for user $5 by $6(uid=$7)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[5].value">/Authorization/Modify</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[6].value">OK</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[7].value">0</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[8].value">$5</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[9]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[9].value">$2</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[10]">srcUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[3].field[10].value">$6</entry>

<entry key="mapper[0].subMapper[1].mapper[4].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[4].sample"><![CDATA[<86>login: pam_unix(remote:session): session closed for user admin]]></entry>
<entry key="mapper[0].subMapper[1].mapper[4].name"><![CDATA[login授权信息：会话关闭]]></entry>
<entry key="mapper[0].subMapper[1].mapper[4].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (session closed for user (\S+))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[4].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[0].value"><![CDATA[login: $2 Session closed]]></entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[1].value"><![CDATA[login：$2 session,session closed for user $5]]></entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[5].value">/Authorization/Modify</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[6].value">OK</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[7].value">0</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[8].value">$5</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[9]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[4].field[9].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[5].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[5].sample"><![CDATA[<85>login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.40.214]]></entry>
<entry key="mapper[0].subMapper[1].mapper[5].name"><![CDATA[pam登入验证失败]]></entry>
<entry key="mapper[0].subMapper[1].mapper[5].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (authentication failure); logname=(\S*)\s*uid=(\d*)\s*euid=(\d*)\s*tty=(\S*)\s*ruser=(\S*)\s*rhost=(([\d\.]+)|(\S+))?(?: user=(\S*))?]]></entry>
<entry key="mapper[0].subMapper[1].mapper[5].fieldCount">14</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[0].value"><![CDATA[login: $2 authenticate failure]]></entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[1].value"><![CDATA[login: $9 user $2 authenticate failure from $10,appProtocol is $8,uid is $6 ,euid is $7.]]></entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[7].value">4</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[8]">srcUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[8].value">$9</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[9]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[9].value">$2</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[10]">srcHostName</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[10].value">$10</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[11]">srcAddress</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[11].value">$11</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[12]">appProtocol</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[12].value">$8</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[13]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[5].field[13].value">$12</entry>

<entry key="mapper[0].subMapper[1].mapper[6].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[6].sample"><![CDATA[<81>login: pam_unix(remote:auth): check pass; user unknown]]></entry>
<entry key="mapper[0].subMapper[1].mapper[6].name"><![CDATA[pam登入验证通过]]></entry>
<entry key="mapper[0].subMapper[1].mapper[6].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (check pass; user (\S+))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[6].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[0].value"><![CDATA[login: $2 auth check pass]]></entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[1].value"><![CDATA[login: $5 user $2 auth check pass.]]></entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[6].value">OK</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[7].value">0</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[8].value">$5</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[9]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[6].field[9].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[7].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[7].sample"><![CDATA[<82>login: pam_succeed_if(remote:auth): error retrieving information about user]]></entry>
<entry key="mapper[0].subMapper[1].mapper[7].name"><![CDATA[Pam Retrieve Error]]></entry>
<entry key="mapper[0].subMapper[1].mapper[7].pattern"><![CDATA[pam_succeed_if\(((\S+):(\S+))\): (error retrieving information about user\s*(\S*))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[7].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[0].value"><![CDATA[login: $2 $3 Retrieve Error]]></entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[1].value"><![CDATA[login: $4]]></entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[7].value">4</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[8].value">$5</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[9]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[7].field[9].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[8].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[8].sample"><![CDATA[<84>login: pam_securetty(remote:auth): access denied: tty 'pts/3' is not secure !]]></entry>
<entry key="mapper[0].subMapper[1].mapper[8].name"><![CDATA[Pam Securetty Denied]]></entry>
<entry key="mapper[0].subMapper[1].mapper[8].pattern"><![CDATA[pam_securetty\(((\S+):(\S+))\): (access denied: tty \'(\S+)\' is not secure)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[8].fieldCount">9</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[0].value"><![CDATA[login: $2 $3 Securetty Denied]]></entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[1].value"><![CDATA[login: $4]]></entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[7].value">4</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[8]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[8].field[8].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[9].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[9].sample"><![CDATA[<85>login: pam_selinux(remote:session): Warning! Could not get new context for /dev/pts/3, not relabeling: Invalid argument]]></entry>
<entry key="mapper[0].subMapper[1].mapper[9].name"><![CDATA[Pam Login Warning]]></entry>
<entry key="mapper[0].subMapper[1].mapper[9].pattern"><![CDATA[pam_selinux\(((\S+):(\S+))\): (Warning!.*)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[9].fieldCount">9</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[0].value"><![CDATA[login: $2 $3 Login Warning]]></entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[1].value"><![CDATA[login: $4]]></entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[7].value">4</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[8]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[9].field[8].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[10].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[10].sample"><![CDATA[<83>login: pam_unix(remote:auth): bad username []]]></entry>
<entry key="mapper[0].subMapper[1].mapper[10].name"><![CDATA[Pam Login Bad Username]]></entry>
<entry key="mapper[0].subMapper[1].mapper[10].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (bad username \[(.*)\])]]></entry>
<entry key="mapper[0].subMapper[1].mapper[10].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[0].value"><![CDATA[login: $2 $3 Login Bad Username]]></entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[1].value"><![CDATA[$2 $3 Login Bad Username $5]]></entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[7].value">4</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[8]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[8].value">$2</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[9]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[10].field[9].value">$5</entry>

<entry key="mapper[0].subMapper[1].mapper[11].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[11].sample"><![CDATA[<85>login: pam_selinux(remote:session): usercon=(null), prev_context=system_u:object_r:telnetd_devpts_t]]></entry>
<entry key="mapper[0].subMapper[1].mapper[11].name"><![CDATA[Pam Login-Usercon]]></entry>
<entry key="mapper[0].subMapper[1].mapper[11].pattern"><![CDATA[pam_selinux\(((\S+):(\S+))\): (usercon=\(.*\),.*)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[11].fieldCount">9</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[0].value"><![CDATA[login: $2 $3 Login Usercon]]></entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[1].value"><![CDATA[$2 $3 Login $4]]></entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[7].value">3</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[8]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[11].field[8].value">$2</entry>

<entry key="mapper[0].subMapper[1].mapper[12].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[12].sample"><![CDATA[<82>login: pam_unix(gnome-screensaver:auth): auth could not identify password for [admin]]]></entry>
<entry key="mapper[0].subMapper[1].mapper[12].name"><![CDATA[Pam auth could not identify password]]></entry>
<entry key="mapper[0].subMapper[1].mapper[12].pattern"><![CDATA[pam_unix\(((\S+):(\S+))\): (auth could not identify password for \[(\S+)\])]]></entry>
<entry key="mapper[0].subMapper[1].mapper[12].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[0].value"><![CDATA[auth could not identify password]]></entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[1].value"><![CDATA[$2 auth could not identify password for $5]]></entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[7].value">3</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[8]">loginType</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[8].value">$2</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[9]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[12].field[9].value">$5</entry>

<entry key="mapper[0].subMapper[1].mapper[13].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[13].sample"><![CDATA[<82>login: pam_unix(gnome-screensaver:auth): auth could not identify password for [admin]]]></entry>
<entry key="mapper[0].subMapper[1].mapper[13].name"><![CDATA[Pam auth could not identify password]]></entry>
<entry key="mapper[0].subMapper[1].mapper[13].pattern"><![CDATA[\[ID (\d+) (\S+)\] (\S+) LOGIN (\S+) FROM (([\d\.]+)|(\S+))]]></entry>
<entry key="mapper[0].subMapper[1].mapper[13].fieldCount">11</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[0].value"><![CDATA[$2]]></entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[1].value"><![CDATA[login: [ID $1 $2] $3 LOGIN $4 FROM $5]]></entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[6].value">FAIL</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[7].value">2</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[8]">srcHostName</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[8].value">$5</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[9]">srcAddress</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[9].value">$6</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[10]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[13].field[10].value">$3</entry>

<entry key="mapper[0].subMapper[1].mapper[14].source">${b}</entry>
<entry key="mapper[0].subMapper[1].mapper[14].sample"><![CDATA[<85>login: ROOT LOGIN ON tty1]]></entry>
<entry key="mapper[0].subMapper[1].mapper[14].name"><![CDATA[用户在接口登录]]></entry>
<entry key="mapper[0].subMapper[1].mapper[14].pattern"><![CDATA[(\S+) LOGIN ON (\S*)]]></entry>
<entry key="mapper[0].subMapper[1].mapper[14].fieldCount">10</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[0]">name</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[0].value"><![CDATA[用户 $1 登录]]></entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[1]">message</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[1].value"><![CDATA[用户 $1 在接口 $2 登录。]]></entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[2]">deviceCat</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[2].value">/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[3]">catObject</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[3].value">/Host/OperatingSystem</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[4]">catTechnique</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[4].value">/UNKNOW</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[5]">catBehavior</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[5].value">/Authentication/Verify</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[6]">catOutcome</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[6].value">OK</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[7]">severity</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[7].value">0</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[8]">destUserName</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[8].value">$1</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[9]">dvcInInterface</entry>
<entry key="mapper[0].subMapper[1].mapper[14].field[9].value">$2</entry>

<entry key="mapper[1].sample"><![CDATA[May 29 14:23:18 192.168.1.1 login[8674]: FAILED LOGIN 1 FROM 192.168.6.112 FOR root, Authentication failure ]]></entry>
<entry key="mapper[1].enable">true</entry>
<entry key="mapper[1].name">Authentication failure</entry>
<entry key="mapper[1].pattern"><![CDATA[login\[(\d+)\]: FAILED LOGIN (\d+) FROM ([\d\.]+) FOR (\S+), Authentication failure]]></entry>
<entry key="mapper[1].recognize"><![CDATA[login\[(\d+)\]: FAILED LOGIN (\d+) FROM ([\d\.]+) FOR (\S+), Authentication failure]]></entry>
<entry key="mapper[1].fieldCount">16</entry>
<entry key="mapper[1].field[0]">deviceCat</entry>
<entry key="mapper[1].field[0].value">OperatingSystem</entry>
<entry key="mapper[1].field[1]">catObject</entry>
<entry key="mapper[1].field[1].value">/Host/OperatingSystem</entry>
<entry key="mapper[1].field[2]">catTechnique</entry>
<entry key="mapper[1].field[2].value">/Service/ServicePortVisit</entry>
<entry key="mapper[1].field[3]">catBehavior</entry>
<entry key="mapper[1].field[3].value">/Authentication/Verify</entry>
<entry key="mapper[1].field[4]">catOutcome</entry>
<entry key="mapper[1].field[4].value">FAIL</entry>
<entry key="mapper[1].field[5]">srcAddress</entry>
<entry key="mapper[1].field[5].value">$3</entry>
<entry key="mapper[1].field[6]">destUserName</entry>
<entry key="mapper[1].field[6].value">$4</entry>
<entry key="mapper[1].field[7]">severity</entry>
<entry key="mapper[1].field[7].value">4</entry>
<entry key="mapper[1].field[8]">name</entry>
<entry key="mapper[1].field[8].value"><![CDATA[Authentication failure]]></entry>
<entry key="mapper[1].field[9]">manufacturer</entry>
<entry key="mapper[1].field[9].value"><![CDATA[UNIX Server]]></entry>
<entry key="mapper[1].field[10]">message</entry>
<entry key="mapper[1].field[10].value"><![CDATA[FAILED LOGIN FROM $3 FOR $4]]></entry>
<entry key="mapper[1].field[11]">destAddress</entry>
<entry key="mapper[1].field[11].value">${deviceAddress}</entry>
<entry key="mapper[1].field[12]">deviceReceiptTime</entry>
<entry key="mapper[1].field[12].value">${collectorReceiptTime}</entry>
<entry key="mapper[1].field[13]">startTime</entry>
<entry key="mapper[1].field[13].value">${deviceReceiptTime}</entry>
<entry key="mapper[1].field[14]">endTime</entry>
<entry key="mapper[1].field[14].value">${deviceReceiptTime}</entry>
<entry key="mapper[1].field[15]">msg</entry>
<entry key="mapper[1].field[15].value"><![CDATA[此条规则是从mapper.unix-OS-syslog.properties.xml转过来的，之所以没有加入到子规则,是因为mapper.topsec-firewall.properties.xml里面也有类似的login日志规则，两者头部极其类似。]]></entry>

<entry key="mapper[2].sample"><![CDATA[May 31 09:16:34 192.168.1.1 login: [ID 254462 auth.notice] ROOT LOGIN /dev/pts/3 FROM 192.168.6.124]]></entry>
<entry key="mapper[2].enable">true</entry>
<entry key="mapper[2].name">auth notice</entry>
<entry key="mapper[2].pattern"><![CDATA[login: \[ID (\d+) (\S+)\] (\S+) LOGIN (\S+) FROM (([\d\.]+)|(\S+))]]></entry>
<entry key="mapper[2].recognize"><![CDATA[login: \[ID (\d+) (\S+)\] (\S+) LOGIN (\S+) FROM ([\d\.]+)]]></entry>
<entry key="mapper[2].fieldCount">17</entry>
<entry key="mapper[2].field[0]">deviceCat</entry>
<entry key="mapper[2].field[0].value">OperatingSystem</entry>
<entry key="mapper[2].field[1]">catObject</entry>
<entry key="mapper[2].field[1].value">/Host/OperatingSystem</entry>
<entry key="mapper[2].field[2]">catTechnique</entry>
<entry key="mapper[2].field[2].value">/Service/ServicePortVisit</entry>
<entry key="mapper[2].field[3]">catBehavior</entry>
<entry key="mapper[2].field[3].value">/Authentication/Verify</entry>
<entry key="mapper[2].field[4]">catOutcome</entry>
<entry key="mapper[2].field[4].value">OK</entry>
<entry key="mapper[2].field[5]">destUserName</entry>
<entry key="mapper[2].field[5].value">$3</entry>
<entry key="mapper[2].field[6]">srcAddress</entry>
<entry key="mapper[2].field[6].value">$6</entry>
<entry key="mapper[2].field[7]">severity</entry>
<entry key="mapper[2].field[7].value">2</entry>
<entry key="mapper[2].field[8]">name</entry>
<entry key="mapper[2].field[8].value">$2</entry>
<entry key="mapper[2].field[9]">manufacturer</entry>
<entry key="mapper[2].field[9].value"><![CDATA[UNIX]]></entry>
<entry key="mapper[2].field[10]">message</entry>
<entry key="mapper[2].field[10].value"><![CDATA[login: [ID $1 $2] $3 LOGIN $4 FROM $5]]></entry>
<entry key="mapper[2].field[11]">destAddress</entry>
<entry key="mapper[2].field[11].value">${deviceAddress}</entry>
<entry key="mapper[2].field[12]">deviceReceiptTime</entry>
<entry key="mapper[2].field[12].value">${collectorReceiptTime}</entry>
<entry key="mapper[2].field[13]">startTime</entry>
<entry key="mapper[2].field[13].value">${deviceReceiptTime}</entry>
<entry key="mapper[2].field[14]">endTime</entry>
<entry key="mapper[2].field[14].value">${deviceReceiptTime}</entry>
<entry key="mapper[2].field[15]">msg</entry>
<entry key="mapper[2].field[15].value"><![CDATA[此条规则是从mapper.unix-OS-syslog.properties.xml转过来的，之所以没有加入到子规则,是因为mapper.topsec-firewall.properties.xml里面也有类似的login日志规则，两者头部极其类似。]]></entry>
<entry key="mapper[2].field[16]">srcHostName</entry>
<entry key="mapper[2].field[16].value">$5</entry>

</properties>