<div dir="auto">One additional feature you might be interested in is our cisco-parser() feature.<div dir="auto"><br></div><div dir="auto">It basically expects a flags(no-parse) input and then puts things in the right buckets, while recognising the various formats that cisco uses.</div><div dir="auto"><br></div><div dir="auto">It would be appreciated if you could check if it works with your setup and I can help fixing it up if it doesn't.</div><div dir="auto"><br></div><div dir="auto">The parser got added to recent syslog-ng versions, so you might need to upgrade to a new version.</div><div dir="auto"><br></div><div dir="auto">Bazsi</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Feb 27, 2018 22:29, "Tim Ghetti" <<a href="mailto:tghetti@targetedsupport.com">tghetti@targetedsupport.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-4843604300029153988WordSection1">
<p class="MsoNormal"><span style="color:#1f497d">Thanks!! It sounds like this is part of my problem. If you would be so kind as to send an example (or point me in the right direction) of how you are changing the program name and message body for the cisco logs
that would be extremely helpful.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">I also suspect that there may be another issue. I’m almost certain that my parser should be picking up at least some of the logs but I am not seeing any of the fields in ES showing up based on parsed logs. Assuming
that patterndb is working, would the below config be correct for getting patterndb parsed variables to show as fields in ES?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal">destination d_elastic {<u></u><u></u></p>
<p class="MsoNormal"> elasticsearch2(<u></u><u></u></p>
<p class="MsoNormal"> client-mode("http")<u></u><u></u></p>
<p class="MsoNormal"> cluster("ITESCL001")<u></u><u></u></p>
<p class="MsoNormal"> index("logstash-syslogng_${<wbr>YEAR}.${MONTH}.${DAY}")<u></u><u></u></p>
<p class="MsoNormal"> cluster-url("<a href="http://X.X.X.X:9200" target="_blank">http://X.X.X.X:<wbr>9200</a>")<u></u><u></u></p>
<p class="MsoNormal"> type("syslog")<u></u><u></u></p>
<p class="MsoNormal"> flush-limit("1")<u></u><u></u></p>
<p class="MsoNormal"> );<u></u><u></u></p>
<p class="MsoNormal">};<u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> syslog-ng [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@<wbr>lists.balabit.hu</a>]
<b>On Behalf Of </b>Evan Rempel<br>
<b>Sent:</b> Tuesday, February 27, 2018 9:06 PM<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">The program name will have an implied @ANYSTRING@ on the end, so if the syslog payload could<br>
be parsed to detect the program name of %ASA..... then your patterndb.xml would work.<br>
The problem is that they syslog payload can not be parsed.<br>
<br>
What we do is use a hand crafted patterndb to detect all of the different problem formats<br>
that Cisco logs (in our environment) and change<br>
<br>
a) the PROGRAM to be cisco_ASA or generally cisco_XXX where the XXX is the leading characters of the %XXX-#-##### of the syslog body.<br>
b) the MESSAGE to be %XXX-#-####... for the rest of the line.<br>
<br>
All of the poor hosts, sequence numbers, timestamps etc are all thrown away.<br>
<br>
After that, the internal buffers of syslog-ng contain a usable PROGRAM and MESSAGE such that we can use<br>
a patterndb to match the message part of the log line.<br>
<br>
This does mean that we have two patterndb parsers for every log line but it seems to work well for us.<br>
What would work better is if Cisco would fix their logging, but that isn't going to happen in my lifetime :-(<br>
<br>
I hope that makes sense.<br>
<br>
Evan.<br>
<br>
On 02/27/2018 05:37 PM, Tim Ghetti wrote:<span style="font-size:12.0pt"><u></u><u></u></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#1f497d">Ok, that makes sense. I sort of suspected that this was due to the program name not matching, since pdbtool works when specifying the program name. Do you know if there is a way to configure patterndb so that
it matches the program name, regardless of the full program name with event code? Is it possible to regex the program or use the patterndb format i.e. <pattern>%ASA@ANYSTRING::@</<wbr>pattern> or something similar?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Tim</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> syslog-ng [<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">mailto:syslog-ng-bounces@<wbr>lists.balabit.hu</a>]
<b>On Behalf Of </b>Evan Rempel<br>
<b>Sent:</b> Tuesday, February 27, 2018 8:26 PM<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Welcome to the horrible world of Cisco logging :-(<br>
<br>
The issue you are bumping into is that when these log lines are parsed by syslog-ng (or any<br>
syslog daemon that does not specifically understand Cisco logs) there is no program name, or the<br>
program name is the full %ASA-4-106023 part of the log line. There are so many ways that Cisco<br>
can log incorrectly it is not possible to say without seeing your exact log lines.<br>
<br>
Cisco can add a * to the date/time stamp to indicate that there is no time server configured on the device.<br>
That makes the date/time invalid as far as parsing is concerned.<br>
<br>
Cisco can add a period (.) to the date/time stamp to indicate that there is a time server configured on<br>
the device, but the time server can not be reached. Again, this makes the date/time invalid as far as parsing<br>
is concerned.<br>
<br>
Cisco can add a sequence number at the start of the log line rather than starting the line with a date/6time stamp.<br>
Invalid parsing again.<br>
<br>
Cisco can leave out the sequence number but still include the trailing colon from the sequence number.
<br>
<br>
You get the idea. So many ways to get it wrong, and they never get it right :-(<br>
<br>
Evan.<br>
<br>
On 02/27/2018 04:46 PM, Tim Ghetti wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi – having some trouble getting paterndb functional and looking for some help. I would like to use patterndb to parse my cisco ass firewall logs before sending it to elasticsearch. However when the messages get to elasticsearch, I don’t
see the messages being parsed. Running pdbtool against the logs seems to work.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"># pdbtool match -p /etc/syslog-ng/patterndb.d/<wbr>ciscoasa.pdb -P %ASA -f /var/log/asatest.log |more<u></u><u></u></p>
<p class="MsoNormal">HOST=<span style="color:#1f497d">X.X.X.X</span><u></u><u></u></p>
<p class="MsoNormal">MESSAGE=Built dynamic TCP translation from INSIDE:X.X.X.X/X to OUTSIDE:X.X.X.X/X<u></u><u></u></p>
<p class="MsoNormal">PROGRAM=%ASA-6-305011<u></u><u></u></p>
<p class="MsoNormal">LEGACY_MSGHDR=%ASA-6-305011: <u></u><u></u></p>
<p class="MsoNormal">.classifier.class=system<u></u><u></u></p>
<p class="MsoNormal">.classifier.rule_id=e075efdc-<wbr>c25f-5e49-a208-7661e3b5a29b<u></u><u></u></p>
<p class="MsoNormal">Protocol=TCP<u></u><u></u></p>
<p class="MsoNormal">GlobalIP=X.X.X.X<u></u><u></u></p>
<p class="MsoNormal">GlobalPort=X<u></u><u></u></p>
<p class="MsoNormal">LocalIP=X.X.X.X<u></u><u></u></p>
<p class="MsoNormal">LocalPort=X<u></u><u></u></p>
<p class="MsoNormal">TAGS=.classifier.system<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">**********************<u></u><u></u></p>
<p class="MsoNormal">SYSLOG-NG CONF FILE<u></u><u></u></p>
<p class="MsoNormal">@version: 3.11<u></u><u></u></p>
<p class="MsoNormal">source s_network { tcp(); udp(); };<u></u><u></u></p>
<p class="MsoNormal">destination d_elastic {<u></u><u></u></p>
<p class="MsoNormal"> elasticsearch2(<u></u><u></u></p>
<p class="MsoNormal"> client-mode("http")<u></u><u></u></p>
<p class="MsoNormal"> cluster("ITESCL001")<u></u><u></u></p>
<p class="MsoNormal"> index("logstash-syslogng_${<wbr>YEAR}.${MONTH}.${DAY}")<u></u><u></u></p>
<p class="MsoNormal"> cluster-url("<a href="http://X.X.X.X:9200" target="_blank">http://X.X.X.X:<wbr>9200</a>")<u></u><u></u></p>
<p class="MsoNormal"> type("syslog")<u></u><u></u></p>
<p class="MsoNormal"> flush-limit("1")<u></u><u></u></p>
<p class="MsoNormal"> );<u></u><u></u></p>
<p class="MsoNormal">};<u></u><u></u></p>
<p class="MsoNormal">destination d_catchall { file("/var/log/catchall.log"); };<u></u><u></u></p>
<p class="MsoNormal">filter f_ciscoasa { host("X.X.X.X"); };<u></u><u></u></p>
<p class="MsoNormal">parser p_ciscoasa {db-parser(file("/etc/syslog-<wbr>ng/patterndb.d/ciscoasa.pdb"))<wbr>;};<u></u><u></u></p>
<p class="MsoNormal">log { source(s_network); filter(f_ciscoasa); parser(p_ciscoasa); destination(d_elastic); flags(final, flow-control); };<u></u><u></u></p>
<p class="MsoNormal">log { source(s_network); destination(d_catchall); };<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">**********************<u></u><u></u></p>
<p class="MsoNormal">PATTERNDB FILE<u></u><u></u></p>
<p class="MsoNormal"><?xml version='1.0' encoding='UTF-8'?><u></u><u></u></p>
<p class="MsoNormal"><patterndb version='4' pub_date='2018-02-19'><u></u><u></u></p>
<p class="MsoNormal"> <ruleset name='%ASA' id='a300d776-8bd7-834d-a4a9-<wbr>23eb81a4b3ba'><u></u><u></u></p>
<p class="MsoNormal"> <pattern>%ASA</pattern><u></u><u></u></p>
<p class="MsoNormal"> <description><u></u><u></u></p>
<p class="MsoNormal"> This ruleset covers the Cisco ASA firewalls<u></u><u></u></p>
<p class="MsoNormal"> </description><u></u><u></u></p>
<p class="MsoNormal"> <rules><u></u><u></u></p>
<p class="MsoNormal"> <rule provider="%ASA" id="b3de7699-8213-c744-944e-<wbr>9413298afe86" class="system"><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1594 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Teardown @ESTRING:Protocol: @connection for faddr @IPv4:SrcIP:/@@ESTRING:<wbr>SrcPort: @gaddr @IPv4:GlobalIP:/@@ESTRING:<wbr>GlobalPort: @laddr @IPv4:LocalIP:/@@ESTRING:<wbr>LocalPort:@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Teardown ICMP connection for faddr X.X.X.X/X gaddr X.X.X.X/X laddr X.X.X.X/X</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='90d0f8c9-7591-d44e-b886-<wbr>2f7e5cb17ce6' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1369 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Teardown dynamic @ESTRING:Protocol: @translation from @ESTRING:::@@IPv4:LocalIP:/@@<wbr>ESTRING:LocalPort: @to @ESTRING:::@@IPv4:GlobalIP:/@@<wbr>ESTRING:GlobalPort: @duration@ANYSTRING::@</<wbr>pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Teardown dynamic UDP translation from any:X.X.X.X/X to outside:X.X.X.X/X duration 0:00:00</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='8f0a8d57-80c6-4745-8a8a-<wbr>5ce018bb0d87' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1254 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Teardown @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:DstIP:/@@<wbr>ESTRING:DstPort: @to @ESTRING:::@@IPv4:SrcIP:/@@<wbr>ESTRING:SrcPort: @@ESTRING::@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Teardown UDP connection <a href="tel:(55)%20101%20037" value="+3655101037" target="_blank">55101037</a> for outside:X.X.X.X/X to inside:X.X.X.X/X duration 0:00:00 bytes 132</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='00c0732d-1e34-7340-a75f-<wbr>21198bf71137' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1256 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Built outbound @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:DstIP:/@@<wbr>ESTRING:DstPort: @(@ESTRING::)@ to @ESTRING:::@@IPv4:SrcIP:/@@<wbr>ESTRING:SrcPort: @(@ESTRING::)@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Built outbound UDP connection <a href="tel:(55)%20101%20037" value="+3655101037" target="_blank">55101037</a> for outside:X.X.X.X/X (X.X.X.X/X) to inside:X.X.X.X/X (X.X.X.X/X)</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='4a586711-ebe2-dc4d-bf6e-<wbr>e512666d8c5d' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1594 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Built inbound @ESTRING:Protocol: @connection for faddr @IPv4:SrcIP:/@@ESTRING:<wbr>SrcPort: @gaddr @IPv4:GlobalIP:/@@ESTRING:<wbr>GlobalPort: @laddr @IPv4:LocalIP:/@@ESTRING:<wbr>LocalPort:@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Built inbound ICMP connection for faddr X.X.X.X/X gaddr X.X.X.X/X laddr X.X.X.X/X</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='8be7928d-66e7-7042-abd5-<wbr>869d6b49c56e' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1763 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Built inbound @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING::@@IPv4:SrcIP:/@@<wbr>ESTRING:SrcPort: @(@ESTRING::)@ to identity:@IPv4:DstIP:/@@<wbr>ESTRING:DstPort: @(@ESTRING::)@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Built inbound UDP connection <a href="tel:(55)%20101%20078" value="+3655101078" target="_blank">55101078</a> for inside:X.X.X.X/X (X.X.X.X/X) to identity:X.X.X.X/X (X.X.X.X/X)</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='20aee256-b4f0-8b4d-93cb-<wbr>263d5338fd21' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 1539 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Teardown @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:SrcIP:/@@<wbr>ESTRING:SrcPort: @to identity:@IPv4:DstIP:/@@<wbr>ESTRING:DstPort: @duration@ANYSTRING::@</<wbr>pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Teardown UDP connection <a href="tel:(55)%20101%20084" value="+3655101084" target="_blank">55101084</a> for inside:X.X.X.X/X to identity:X.X.X.X/X duration 0:02:01 bytes 88</test_message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule id='e075efdc-c25f-5e49-a208-<wbr>7661e3b5a29b' class='system' provider='%ASA'><u></u><u></u></p>
<p class="MsoNormal"> <!-- support: 3648 --><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Built dynamic @ESTRING:Protocol: @translation from @ESTRING:::@@IPv4:LocalIP:/@@<wbr>ESTRING:LocalPort: @to @ESTRING:::@@IPv4:GlobalIP:/@@<wbr>ESTRING:GlobalPort:@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> <examples><u></u><u></u></p>
<p class="MsoNormal"> <example><u></u><u></u></p>
<p class="MsoNormal"> <test_message program='%ASA'>Built dynamic TCP translation from any:X.X.X.X/X to outside:X.X.X.X/X</test_<wbr>message><u></u><u></u></p>
<p class="MsoNormal"> </example><u></u><u></u></p>
<p class="MsoNormal"> </examples><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> <rule provider='%ASA' class='system' id='39'><u></u><u></u></p>
<p class="MsoNormal"> <patterns><u></u><u></u></p>
<p class="MsoNormal"> <pattern>Cleared @ESTRING:: @urgent flag from @ESTRING:::@@ESTRING::/@@<wbr>NUMBER::@ to @ESTRING: ::@@ESTRING::/@@NUMBER::@</<wbr>pattern><u></u><u></u></p>
<p class="MsoNormal"> <pattern>regular translation creation failed for @ESTRING:: @src @ESTRING:::@@ESTRING:: @dst @ESTRING: ::@@ESTRING:: @(type @NUMBER::@, code @NUMBER::@</pattern><u></u><u></u></p>
<p class="MsoNormal"> </patterns><u></u><u></u></p>
<p class="MsoNormal"> </rule><u></u><u></u></p>
<p class="MsoNormal"> </rules><u></u><u></u></p>
<p class="MsoNormal"> </ruleset><u></u><u></u></p>
<p class="MsoNormal"></patterndb><u></u><u></u></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman ,serif",serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><br>
<br>
<br>
<u></u><u></u></span></p>
<pre>N<span style="font-family:"Tahoma",sans-serif">�</span>n<span style="font-family:"Tahoma",sans-serif">�</span>r<span style="font-family:"Tahoma",sans-serif">����</span>)em<span style="font-family:"Tahoma",sans-serif">�</span>h<span style="font-family:"Tahoma",sans-serif">�</span>yhiם<span style="font-family:"Tahoma",sans-serif">�</span>w^<span style="font-family:"Tahoma",sans-serif">��</span><u></u><u></u></pre>
</blockquote>
<p><u></u> <u></u></p>
</div>
</div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div></div>