Reference
Events
The sshd log lines Gabier recognises — accepted logins, failed passwords, invalid users and closed sessions — the fields parsed from each, and the order the filters run in.
Gabier reads sshd’s log lines and turns four of them into events. Everything else — the pam session noise above all — is dropped before it costs anything.
Accepted publickey for root from 203.0.113.42 port 51288 ssh2: ED25519 SHA256:…
Failed password for root from 185.243.96.107 port 2222 ssh2
Failed password for invalid user oracle from 185.243.96.107 port 2244 ssh2
Connection closed by authenticating user root 185.243.96.107 port 2222
Each one has its own toggle in [events]. closed is off by default: it
roughly doubles the volume and rarely tells you anything the other three did not.
Fields
| Field | Present on | Notes |
|---|---|---|
user | all | The account named in the line. |
ip | all | Source address. The throttle key. |
port | all | Source port. sshd reuses it across the three password attempts of one connection. |
method | accepted, failed | publickey, password, keyboard-interactive… |
key | accepted | Key type and fingerprint, when the method is publickey. |
The server name from [server] name is attached to every notification, which is
what lets one channel carry several machines.
Geolocation
With geoip = true, Gabier resolves the source IP to a country, city and network operator and adds them to
the message.
Filter order
For each parsed event, in order:
- Event toggle — is this kind enabled in
[events]? - Deduplication — is this the same attempt already seen on this connection?
- Throttle — has this IP used up its
burstfor the window? If so, count it for the summary. - Fan out — build the payload and POST it to every configured destination.
A drop at any step costs nothing more; the line is forgotten and the next one is read.
Why so few lines
sshd’s log format has been stable for a very long time, and these four lines answer the whole question of
“who got in, and who tried”. The parser lives in one file and is covered by tests against a real
auth.log fixture, so a distribution
that formats a line differently is a one-line fix with a test rather than an architectural problem.
There is no history and no state across restarts: Gabier reports what just happened and forgets it. Your journal is already the log of record.