os-crowdsec (1.10.12): opnsense-gui-logs and sshd-logs parsers do not match OPNsense 26.1.9 audit log format

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• [X ] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• [X ] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• [ X] The title contains the plugin to which this issue belongs

Describe the bug
The crowdsecurity/opnsense-gui-logs and crowdsecurity/sshd-logs parsers do not match the audit log format used by OPNsense 26.1.9. All authentication-related log lines show parser failure at s01-parse despite syslog-logs parsing successfully at s00-raw.

Parser expects:
/index.php: Web GUI authentication error for 'username' from 1.2.3.4

Actual log format in /var/log/audit/latest.log:
user installer failed authentication for login on OPNsense\Auth\Services\System via OPNsense\Auth\Local

cscli explain output:
line: <39>1 2026-06-07T05:45:06+00:00 OPNsense.internal audit 41095 - [meta sequenceId="18"] user installer failed authentication for login on OPNsense\Auth\Services\System via OPNsense\Auth\Local
├ s00-raw
| └ 🟢 crowdsecurity/syslog-logs (+15 ~9)
├ s01-parse
| ├ 🔴 crowdsecurity/opnsense-gui-logs
| ├ 🔴 firewallservices/pf-logs
| ├ 🔴 firewallservices/pf-logs-drop
| ├ 🔴 crowdsecurity/sshd-logs
| └ 🔴 crowdsecurity/sshd-success-logs
└-------- parser failure 🔴

line: <39>1 2026-06-07T05:54:19+00:00 OPNsense.internal audit 91309 - [meta sequenceId="1"] user \x1b[6~\x1b\x1b[6~ failed authentication for login on OPNsense\Auth\Services\System via OPNsense\Auth\Local
├ s00-raw
| └ 🟢 crowdsecurity/syslog-logs (+15 ~9)
├ s01-parse
| ├ 🔴 crowdsecurity/opnsense-gui-logs
| ├ 🔴 firewallservices/pf-logs
| ├ 🔴 firewallservices/pf-logs-drop
| ├ 🔴 crowdsecurity/sshd-logs
| └ 🔴 crowdsecurity/sshd-success-logs
└-------- parser failure 🔴

cscli metrics show parsers output:

Parser Metrics

│ Parser----------------------------------│ Hits │ Parsed │ Unparsed │
│ child-crowdsecurity/syslog-logs------| 2.65k │ 1.32k----│ 1.32k-----│
│ crowdsecurity/dateparse-enrich------│ 210 │ 210 ----│ -----------│
│ crowdsecurity/geoip-enrich---------- │ 160 │ 160----│ ------------│
│ crowdsecurity/public-dns-allowlist---│ 210 │ 210 ----│ ------------|
│ crowdsecurity/syslog-logs------------│ 1.32k │ 1.32k---|-------------│
│ firewallservices/pf-logs----------------│ 920 │ 907----│ 13--------│
│ firewallservices/pf-logs-drop---------│ 210 │ 210-----│ ------------│

To Reproduce
Steps to reproduce the behavior:

1. Install os-crowdsec on OPNsense 26.1.x
2. Run: grep "authentication" /var/log/audit/latest.log | tail -3 | cscli explain -f- --type syslog
3. Observe parser failure at s01-parse for crowdsecurity/opnsense-gui-logs

Expected behavior
Failed authentication attempts should be parsed and trigger the crowdsecurity/opnsense-gui-bf brute force scenario.

Relevant log files
onsuccess: next_stage
filter: "evt.Parsed.program == 'audit'"
name: crowdsecurity/opnsense-gui-logs
description: "Parse OPNSense web auth logs"
#/index.php: Web GUI authentication error for 'toto' from 1.2.3.4
grok:
pattern: "/index.php: Web GUI authentication error for '%{USERNAME:username}' from %{IPORHOST:source_ip}"
apply_on: message
statics:

• meta: service
  value: opnsense-gui
• meta: username
  expression: "evt.Parsed.username"
• meta: source_ip
  expression: evt.Parsed.source_ip
• meta: log_type
  value: opnsense-gui-failed-auth

Environment
OPNsense 26.1.9 (amd64).
Ryzen 7 Pro 6850U
Dual Intel® I2226 V 2.5GB NICs
CrowdSec plugin 1.10.12

Start with the crowdsecurity/opnsense-gui-logs parser configuration shown in the issue and reproduce the failure with the listed grep and cscli explain command. Compare the expected and actual audit lines, then verify that failed authentication lines are parsed and trigger the crowdsecurity/opnsense-gui-bf brute-force scenario.