mariadb Free
Refused logins from MariaDB's or MySQL's error log.
Download the pack tar.gz of the files listed below
About this pack
Refused logins from MariaDB's or MySQL's error log
(/var/log/mysql/error.log). Category mysql.
On most hosting machines the database listens on the loopback only, and
this parser will never match a thing — deliberately, because it requires
the host part of 'user'@'host' to look like an address, and
'x'@'localhost' is a local service with the wrong password rather than
an attacker.
That is worth keeping rather than deleting: shield stats prints every
rule's hit count, so a rule reading 0 hits is a visible statement that
this door is shut. The day someone opens 3306 to the world, it starts
working with no change.
Parsers (1)
The building blocks: each parser names a log, a cheap prefilter and the regex that extracts the address.
mariadb-auth-fail mysql
# A refused database login, from the server's error log: # 2026-08-13 10:00:01 6516432 [Warning] Access denied for user 'someone'@'203.0.113.9' (using password: YES) # # The host part is required to look like an address, which is what # leaves the local ones alone: 'user'@'localhost' is a service on this # machine getting its own credentials wrong, not an attack, and there is # nothing to ban. # # NO time_field, deliberately. MariaDB space-pads the hour (" 1:24:55"), # and Go's time layouts have no verb for that — a format that cannot # read the log's own timestamps would make every replayed line undated, # which the dry run reports rather than guessing. Live detection is # unaffected: a line read now happened now. parser: mariadb-auth-fail log: mysql prefilter: "Access denied for user" regex: "\\[Warning\\] Access denied for user '(?P<user>.*)'@'(?P<ip>[0-9a-fA-F.:]+)' "