<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">No, because you can not define a
variable name from the content of the syslog line.<br>
<br>
2015-06-09T11:14:42-07:00 saker.comp.uvic.ca daemon.info snmptrap:
. Cold Start Trap (0) Uptime: 0 seconds
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (235800437) 27
days, 7:00:04.37 SM10-R3-MIB::componentLocation = STRING:
Enclosure 0, Drawer 4 SM10-R3-MIB::componentType = STRING:
Drawer SM10-R3-MIB::deviceErrorCode = STRING: 2857
SM10-R3-MIB::deviceHostIPAddr = STRING: "192.168.21.22"
SM10-R3-MIB::deviceHostIPType = INTEGER: ipv4(1)
SM10-R3-MIB::deviceHostName = STRING: disk11b.westgrid.
SM10-R3-MIB::deviceUserLabel = STRING: disk11_westgrid
SM10-R3-MIB::eventTime = STRING: Jun 9, 2015 11:13:41 AM
SM10-R3-MIB::trapDescription = STRING: Drawer open or removed
SNMPv2-MIB::snmpTrapOID.0 = OID: SM10-R3-MIB::storageArrayCritical<br>
<br>
<br>
we need to make name and values of<br>
<br>
sysUpTimeInstance = 235800437<br>
componentLocation = Enclosure 0, Drawer 4<br>
componentType = Drawer<br>
deviceErrorCode = 2857<br>
deviceHostIPAddr = 192.168.21.22<br>
deviceHostIPType = ipv4(1)<br>
deviceHostName = disk11b.westgrid.<br>
deviceUserLabel = disk11_westgrid<br>
eventTime = Jun 9, 2015 11:13:41 AM<br>
trapDescription = Drawer open or removed<br>
snmpTrapOID.0 = SM10-R3-MIB::storageArrayCritical<br>
<br>
<br>
<br>
On 06/09/2015 11:28 AM, Jim Hendrick wrote:<br>
</div>
<blockquote
cite="mid:jdtr188oic2uich5e2kpv16o.1433874534206@email.android.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>Couldn't that be done using patterndb? </div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="composer_signature">
<div style="font-size:85%;color:#575757">Sent from my Verizon
Wireless 4G LTE smartphone</div>
</div>
<br>
<br>
-------- Original message --------<br>
From: Fabien Wernli <a class="moz-txt-link-rfc2396E" href="mailto:wernli@in2p3.fr"><wernli@in2p3.fr></a> <br>
Date: 06/09/2015 10:29 AM (GMT-05:00) <br>
To: Syslog-ng users' and developers' mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu"><syslog-ng@lists.balabit.hu></a> <br>
Subject: Re: [syslog-ng] Integrating with snmp traps <br>
<br>
Hi,<br>
<br>
On Tue, Jun 09, 2015 at 06:26:40AM -0700, Evan Rempel wrote:<br>
> When you say you "would actually like to parse all the
key-values from <br>
> the original payload" what do you mean?<br>
> Do you want to process them with syslog-ng filters etc, or
are you <br>
> feeding this to another type of structured worker thread?<br>
<br>
I'd like to basically have the structured SNMP message parsed in
syslog-ng,<br>
in the same way json-parser() parses JSON payload, and makes the
key-values<br>
available as macros in syslog-ng.<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation:
<a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="500">--
Evan Rempel <a class="moz-txt-link-abbreviated" href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>
Senior Systems Administrator 250.721.7691
Data Centre Services, University Systems, University of Victoria
</pre>
</body>
</html>