help in proxmox decoders

[bhavesh pandya]

Jul 26 19:32:54 amd3proxmox python3[2580]: [2026-07-26 19:28:24] VM 101 already has SMBIOS configuration

[Olamilekan Abdullateef Ajani]

Hello,

Not sure what you meant, but if it is to help with writing a decoder for the log you shared, I made a sample below, which you can apply to the custom decoder and rules path:

Decoder: /var/ossec/etc/decoders/local_decoder.xml

<decoder name="proxmox-smbios">
  <program_name type="pcre2">^python3$</program_name>
  <prematch type="pcre2">\[\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\]\s+VM\s+\d+\s+already has SMBIOS configuration</prematch>
  <regex type="pcre2">\[(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})\]\s+VM\s+(\d+)\s+(already has SMBIOS configuration)</regex>
  <order>event_time,vm_id,status</order>
</decoder>


Rules: /var/ossec/etc/rules/local_rules.xml
<group name="proxmox,">
  <rule id="110800" level="3">
    <decoded_as>proxmox-smbios</decoded_as>
    <description>Proxmox VM $(vm_id) already has an SMBIOS configuration</description>
     </rule>
</group>

Ref:
https://wazuh.com/blog/creating-decoders-and-rules-from-scratch/
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/decoders.html
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html

Please find the attached result.

[pennywise]

Thanks a lot it works ,

I will let you know for more logs