Add custom parser for Pi-hole logs on ARM/Armbian (dnsmasq v6 format) #1597
+13
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This parser adds support for Pi-hole v6 log format on ARM/Armbian devices, where dnsmasq writes logs directly into /var/log/pihole/*.log instead of syslog/journalctl. Currently, CrowdSec Hub has no parser capable of handling Pi-hole v6 logs, so CrowdSec cannot ingest DNS queries, FTL events, or webserver logs on ARM boards. This parser uses a syslog-style GROK pattern compatible with dnsmasq outputs on Pi-hole v6 and has been tested successfully on Radxa Zero 3 (Armbian) with CrowdSec 1.6. The objective is to help ARM users integrate Pi-hole into CrowdSec without manually creating custom parsers and to make this parser available via Hub so future installations can auto-install it.
Author
|
Additional information: I can provide real Pi-hole v6 log samples if needed, and I can also run This parser fixes a real issue where CrowdSec cannot process Pi-hole v6 The goal is to help other ARM/Pi-hole v6 users avoid manual custom Happy to adjust anything if maintainers need changes. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This parser adds support for Pi-hole v6 log format on ARM/Armbian devices, where dnsmasq writes logs directly into /var/log/pihole/*.log instead of syslog/journalctl.
Currently, CrowdSec Hub has no parser capable of handling Pi-hole v6 logs, so CrowdSec cannot ingest DNS queries, FTL events, or webserver logs on ARM boards.
This parser uses a syslog-style GROK pattern compatible with dnsmasq outputs on Pi-hole v6 and has been tested successfully on Radxa Zero 3 (Armbian) with CrowdSec 1.6.
The objective is to help ARM users integrate Pi-hole into CrowdSec without manually creating custom parsers and to make this parser available via Hub so future installations can auto-install it.
Description
Checklist