<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Microsoft Sans Serif";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
p.m6626295155409041317imprintuniqueid, li.m6626295155409041317imprintuniqueid, div.m6626295155409041317imprintuniqueid
{mso-style-name:m_6626295155409041317imprintuniqueid;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Hey Peter, I just happened to see this email. Nice work!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">One side note: the `*` in a timestamp from Cisco indicates a problem with NTP on that host. So only some message may have that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Here's a paper I wrote when I worked at Cisco that describes this (and more):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">http://www.cisco.com/c/en/us/products/collateral/services/high-availability/white_paper_c11-557812.html#wp9000331<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#AFABAB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#AFABAB"><img width="182" height="108" id="_x0000_i1027" src="cid:image001.png@01D2FEE7.CDFE20D0"></span><span style="font-size:11.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of "Czanik, Péter" <peter.czanik@balabit.com><br>
<b>Reply-To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Date: </b>Monday, July 17, 2017 at 6:51 AM<br>
<b>To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject: </b>Re: [syslog-ng] in-list syntax<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">If you use syslog-ng 3.10 you can give the cisco parser a try:
<a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#cisco-parser">
https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#cisco-parser</a> It parses Cisco log messages (at least a good part of them) and creates name-value pairs from them.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
If 3.10 is not an option for you, first I'd check if the PROGRAM macro really contains the information you are looking for. I usually do that using the format-json template with "--scope everything". It gives a lot more information than necessary, but still
the quickest way to figure it out.<br>
<br>
Or even better: use the Cisco parser for hints how to parse necessary information from logs. It is actually configuration snippet (SCL) and you can browse it on-line:
<a href="https://github.com/balabit/syslog-ng/blob/master/scl/cisco/plugin.conf">
https://github.com/balabit/syslog-ng/blob/master/scl/cisco/plugin.conf</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Bye,<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>
Balabit / syslog-ng upstream<br>
<a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/author/peterczanik/</a><br>
<a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Jul 13, 2017 at 4:07 PM, Damian Bell <<a href="mailto:Damian.Bell@clarksons.com" target="_blank">Damian.Bell@clarksons.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">Hello,
<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">I’ve previously had a very simple regex list configured for Cisco ASA devices to deliver email alerts on routing changes in our network, which was configured
thus:- <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">filter f_sev1 { match("%ASA-3-622001"); };<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">…which works just fine. Wanting to expand this list a bit, and aware that scaling regex matching up is going to incur performance issues, I’ve thought that an
“in-list” expression file might have been a better approach, and as such have configured the following:-
<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">filter f_sev1 { in-list("/etc/syslog-ng/email-match-list.list", value("PROGRAM")); };<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">…where “PROGRAM” is (I believe) the applicable part of the code that matches to the Cisco "%ASA-3-622001" part of the message. The whitelist has the following
entries (as an example):- <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">%DUAL-5-NBRCHANGE<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">%ASA-3-622001<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">%SPANTREE-5-TOPOTRAP<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">%SPANTREE-5-ROOTCHANGE<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">%ASA-5-111010<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">I am not getting any matches here, however. What am I missing?<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">Thanks very much in advance,
<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">Damian
<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-GB"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Calibri;color:#1C3048">Damian</span></b> <b><span style="font-size:10.0pt;font-family:Calibri;color:#1C3048">Bell</span></b><br>
<span style="font-size:10.0pt;font-family:Calibri;color:#595959">Infrastructure Engineer | Support | H Clarkson & Co Ltd</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Calibri;color:#595959">T:
<a href="tel:+44%2020%207334%205483" target="_blank">+44 20 7334 5483</a></span><br>
<span style="font-size:10.0pt;font-family:Calibri;color:#404040">Email: </span><span style="font-size:10.0pt;font-family:Calibri;color:#0070C0"><a href="mailto:Damian.Bell@clarksons.com" target="_blank" title="Click to send email to Damian Bell"><span style="color:#0070C0">Damian.Bell@clarksons.com</span></a></span><br>
<span style="font-size:10.0pt;font-family:Calibri;color:#595959">Group Email: </span>
<span style="font-size:10.0pt;font-family:Calibri;color:#0070C0"><a href="mailto:infrastructure@clarksons.com" target="_blank">infrastructure@clarksons.com</a></span><o:p></o:p></p>
</td>
</tr>
<tr style="height:42.75pt">
<td style="padding:11.25pt 0in 0in 0in;height:42.75pt">
<p class="MsoNormal"><span style="font-size:16.0pt;font-family:Calibri;color:#1C3048">Clarksons Platou</span><span style="font-size:10.0pt;font-family:Calibri;color:#1C3048"> TM</span><br>
<span style="font-size:10.0pt;font-family:Calibri;color:#595959">Commodity Quay, St. Katharine Docks | London E1W 1BF | United Kingdom</span><br>
<span style="font-size:10.0pt;font-family:Calibri;color:#0070C0"><a href="http://www.clarksons.com" target="_blank"><span style="color:#0070C0">www.clarksons.com</span></a></span><o:p></o:p></p>
</td>
</tr>
<tr style="height:23.25pt">
<td style="padding:0in 0in 0in 0in;height:23.25pt">
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Calibri;color:#00863D">Please consider the environment before printing this e-mail</span><o:p></o:p></p>
</td>
</tr>
<tr style="height:18.75pt">
<td style="padding:7.5pt 0in 0in 0in;height:18.75pt"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-GB"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span lang="EN-GB">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:7.5pt;font-family:"Microsoft Sans Serif"">This message is private and confidential. If you have received it in error, you are on notice of its status. Please notify us immediately by reply email and then
delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person: to do so could be a breach of confidence.<br>
<br>
Emails may be monitored.<br>
<br>
Details of Clarkson group companies and their regulators (where applicable) can be found at this url:
</span><span lang="EN-GB"><a href="http://www.clarksons.com/disclosure/" target="_blank" title="Disclosure"><span style="font-size:7.5pt;font-family:"Microsoft Sans Serif"">Disclosure</span></a>
<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span lang="EN-GB">
<hr size="2" width="100%" align="center">
</span></div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>