<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Helvetica Neue";
panose-1:2 0 5 3 0 0 0 2 0 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
span.hljs-symbol
{mso-style-name:hljs-symbol;}
span.hljs-number
{mso-style-name:hljs-number;}
span.hljs-keyword
{mso-style-name:hljs-keyword;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">You can use our docs as a guide if it helps:<o:p></o:p></p>
<p class="MsoNormal"><a href="http://demo.logzilla.net/help/receiving_data/cisco_ios_configuration">http://demo.logzilla.net/help/receiving_data/cisco_ios_configuration</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have also encountered issues with some Cisco gear when the show-timezone command is not used (hosts will come in without a hostname, just a : instead)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For example:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40">On some Cisco IOS versions, it is <b>imperative</b> that this portion of the command be included. Without it, the syslog
daemon may detect your device's hostname as a </span><span style="font-size:10.0pt;font-family:Menlo;color:#BD4147;background:#FFF5F5">:</span><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40"> instead of the actual hostname.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40">For example:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><b><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40">Hostname Missing</span></b><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;line-height:17.15pt;background:#FCFCFD;word-break:break-all">
<span style="font-size:10.0pt;font-family:Menlo;color:#4078F2;background:#FAFAFA">0
</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> :
</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">189</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> UTC %SYS-</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">5</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA">-CONFIG_I:
Configured from console by user1 </span><span style="font-size:10.0pt;font-family:Menlo;color:#A626A4;background:#FAFAFA">on</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> vty3 (</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">192.168.2.207</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA">)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;background:white"><b><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40">Correct Hostname</span></b><span style="font-size:12.0pt;font-family:"Helvetica Neue";color:#343A40"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;line-height:17.15pt;background:#FCFCFD;word-break:break-all">
<span style="font-size:10.0pt;font-family:Menlo;color:#4078F2;background:#FAFAFA">0
</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> </span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">192.168.2.252</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA">
</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">189</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> UTC %SYS-</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">5</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA">-CONFIG_I:
Configured from console by user1 </span><span style="font-size:10.0pt;font-family:Menlo;color:#A626A4;background:#FAFAFA">on</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA"> vty3 (</span><span style="font-size:10.0pt;font-family:Menlo;color:#986801;background:#FAFAFA">192.168.2.207</span><span style="font-size:10.0pt;font-family:Menlo;color:#383A42;background:#FAFAFA">)</span><span style="font-size:10.0pt;font-family:Menlo;color:#212529"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of "N. Pierson" <nmaxpierson@gmail.com><br>
<b>Reply-To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Date: </b>Tuesday, February 26, 2019 at 12:11 PM<br>
<b>To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject: </b>Re: [syslog-ng] Problems parsing Cisco syslogs<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have all devices configured with this exact command minus the show-timezone option and it doesn't seem to make a difference.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Feb 26, 2019 at 11:03 AM Nik Ambrosch <<a href="mailto:nik@ambrosch.com">nik@ambrosch.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal">I had a similar issue, could you try installing this logging configuration on your cisco devices?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">service timestamps log datetime msec localtime show-timezone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Feb 26, 2019 at 11:36 AM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com" target="_blank">nmaxpierson@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi List, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I
do not know how to troubleshoot.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So that I could see exactly what was being parsed, I disabled the default parsing using the below.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">destination d_mysql {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> sql(type(mysql)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> host("127.0.0.1")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> username("syslog-ng")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> password("password")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> database("syslog")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> table("messages_${HOST}")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> indexes("datetime", "level")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> );<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">};<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">log { source(s_network); rewrite(r_cisco); destination(d_mysql); };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header
level. The $HOST macro still works fine however.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Max<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833373551&sdata=kulONTiXvj8%2BpodoTWbmdbvS0q5hfJjLm%2FQqmTDbe48%3D&reserved=0" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833383559&sdata=V5DC31aH0fSKIXrguQLBt0iMjAxqMbSx4hZ%2BNhZu3vI%3D&reserved=0" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833393568&sdata=iynptNkkmdR%2FAknYSBcoWeUlFAGJuCeZxqpLlDUIVH8%3D&reserved=0" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833393568&sdata=qvXCBbfURy%2FlNIjCLO7RNz%2BiBhMOxv4GADc6zM1VJys%3D&reserved=0" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833403576&sdata=J8iBIrYuSYmdUlMalObCFx97hKpKRCGjlRtVkvDKEg8%3D&reserved=0" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833403576&sdata=0Zfirx7WqC%2Bbzfaa3GAXR6gplKkP77J4T%2FwYE%2FWh1rg%3D&reserved=0" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>