# How to record accounts in eve.json when the password is empty？

**URL:** <https://forum.suricata.io/t/how-to-record-accounts-in-eve-json-when-the-password-is-empty/4701>\
**Category:** Help\
**Tags:** rules, suricata\
**Created:** [June 12, 2024, 9:18am UTC](https://forum.suricata.io/t/how-to-record-accounts-in-eve-json-when-the-password-is-empty/4701 "2024-06-12T09:18:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![710425820](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/710425820/32/2929_2.png) [@710425820](https://forum.suricata.io/u/710425820)\
**Post date:** [June 12, 2024, 9:18am UTC](https://forum.suricata.io/t/how-to-record-accounts-in-eve-json-when-the-password-is-empty/4701/1 "2024-06-12T09:18:08Z")

</div>

My requirement is to know the account information when the ftp empty password login alarm occurs  
How do I write rules

```auto
alert ftp any any -> $HOME_NET any (msg:"ftp空密码登录-账号提取"; flow:established,to_server; content:"USER "; depth:5; pcre:"/^USER\s+\S*/i"; sid:2; gid: 214581;)

alert ftp any any -> $HOME_NET any (msg:"ftp空密码登录-前置"; flow:established,to_server; content:"PASS "; depth:5; pcre:"/^PASS\s*$/i"; flowbits:set,session.ftp_empty_pass_login; metadata:attack_result 1, level 2; sid:1; gid: 214581;)

```

The first rule will warn you when all ftp logins are made, not just when there is an empty password. How can I optimize this?

This is Suricata version 7.0.5 RELEASE

lsb\_release -a  
No LSB modules are available.  
Distributor ID: Ubuntu  
Description: Ubuntu 20.04.6 LTS  
Release: 20.04  
Codename: focal

Install from source

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [June 12, 2024, 2:16pm UTC](https://forum.suricata.io/t/how-to-record-accounts-in-eve-json-when-the-password-is-empty/4701/2 "2024-06-12T14:16:33Z")

</div>

The `USER` and `PASS` values won’t be contained in the alert; log records with the `event_type` of `ftp` will contain those when they’re observed.

You can correlate the alert and ftp log records using the `flow_id`.

Is this what you’re after?