<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>The best would be to write a cisco mnemonic parser that would transform that stuff to name-value pairs.
<br>
<br>Also we've used the program name portion in patterndb to parse out those. iirc it starts with %
<br>
<br>----- Original message -----
<br>>
<br>> Does anyone have a pre build set of patterns/rewrite rule to rewrite all
<br>> cisco logs into something that is a little more compliant?
<br>>
<br>> We are trying to use a master pattern database to identify/classify
<br>> messages, but the cisco logs don't have usable "program names" so the
<br>> pattern database can't even get started :-(
<br>>
<br>> Thanks for any pointers.
<br>>
<br>> --
<br>> Evan
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>