<div dir="ltr"><div>Hi Laci,</div><div><br></div><div>The short macro names are only available within the syslog-ng instance that runs the eventlog source. So in this case that would mean the PE 6 Windows Agent, or the already EOL PE server for Windows.</div><div>As the logs are forwarded to an OSE instance, it will only know those macros/data fields as SDATA values, so that's the reason why you have to use the long SDATA names. You can recreate the short macro names from them via rewrite rules if needed, but I think it's easier to use the long names anyway.</div><div>I hope that helps in clearing up that question.</div><div><br></div><div>Best Regards,</div><div>János<br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">--</div><div dir="ltr">Janos SZIGETVARI<br><span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">150-053-692</a></span><br></div><div dir="ltr"><span><br></span></div><div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">linkedin.com/in/janosszigetvari</a></span><br><br><br>__@__˚V˚<br>Make the switch to open (source) applications, protocols, formats now:<br>- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>- msn -> jabber protocol (Pidgin, Google Talk)<br>- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Pal, Laszlo <<a href="mailto:vlad@vlad.hu">vlad@vlad.hu</a>> ezt írta (időpont: 2020. máj. 28., Cs, 12:40):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi,<div><br></div><div>I have a strange issue with templates... Maybe some stupid issue on my side, maybe a bug I don't know</div><div><b><br></b></div><div><b><spoiler> Solutions at the end of this </spoiler></b></div><div><br></div><div>Here is the scenario</div><div><br></div><div>Logs coming from Windows using Syslog-ng Agent (syslog destination)</div><div>Logs received using latest OSE (but same issues at the customer with PE6)</div><div>Logs must be forwarded to Qradar using a special LEEF template like this (there are also tabs in the template). I've tried both network and syslog destination</div><div><br></div><div><div>template t_leefwin {</div><div> template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${EVENT_ID}|<span style="white-space:pre-wrap"> </span>devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET}<span style="white-space:pre-wrap"> </span>devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz<span style="white-space:pre-wrap"> </span>cat=${EVENT_TYPE}<span style="white-space:pre-wrap"> </span>sev=${EVENT_LEVEL}<span style="white-space:pre-wrap"> </span>resource=${HOST}<span style="white-space:pre-wrap"> </span>usrName=${EVENT_USERNAME}<span style="white-space:pre-wrap"> </span>application=${EVENT_SOURCE}<span style="white-space:pre-wrap"> </span>message=${EVENT_MSG}\n");</div><div>};</div></div><div><br></div><div>The forwarded results like this</div><div><46> IP-address LEEF:1.0|Microsoft|Windows|2k8r2||devTime=2020-05-28T09:10:02GMT+02:00<span style="white-space:pre-wrap"> </span>devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz<span style="white-space:pre-wrap"> </span>cat=<span style="white-space:pre-wrap"> </span>sev=<span style="white-space:pre-wrap"> </span>resource=172.17.24.174<span style="white-space:pre-wrap"> </span>usrName=<span style="white-space:pre-wrap"> </span>application=<span style="white-space:pre-wrap"> </span>message=<br></div><div><br></div><div>So, the $macro-s are empty except the one which is not from .sdata (resource)</div><div><br></div><div>I've created a local json and welf destination and I can see the macros there</div><div><br></div><div>SDATA="[win@18372.4 EVENT_CATEGORY=\"None\" EVENT_FACILITY=\"16\" EVENT_ID=\"4098\" EVENT_LEVEL=\"3\" EVENT_NAME=\"Application\" EVENT_REC_NUM=\"73006\" EVENT_SID=\"S-1-5-18\" EVENT_SID_TYPE=\"User\" EVENT_SOURCE=\"Group Policy Services\" EVENT_TYPE=\"Figyelmeztetés\" EVENT_HOST=\"hostname\" EVENT_USERNAME=\"NT AUTHORITY\\\\SYSTEM\"<br></div><div><br></div><div>I remember I used this method years ago to forward logs from syslog-ng agent to Qradar with proper LEEF format and it was ok... but now, some small thing is missing</div><div><br></div><div>Versions</div><div><div>syslog-ng 3 (3.25.1)</div><div>Config version: 3.25</div><div>Installer-Version: 3.25.1</div></div><div><br></div><div>But, we have a similar issue with PE6 at the customer</div><div><br></div><div>Any idea?</div><div><br></div><div>--- so after playing with the welf output a bit, I figured out the short version of the macro names are not longer working somehow, but the long ones are ok like this</div><div><br></div><div><div>template t_leefwin {</div><div> template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${.SDATA.win@18372.4.EVENT_ID}|devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET}<span style="white-space:pre-wrap"> </span>devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz<span style="white-space:pre-wrap"> </span>cat=${.SDATA.win@18372.4.EVENT_TYPE}<span style="white-space:pre-wrap"> </span>sev=${.SDATA.win@18372.4.EVENT_LEVEL}<span style="white-space:pre-wrap"> </span>resource=${SDATA.win@18372.4.EVENT_HOST}<span style="white-space:pre-wrap"> </span>usrName=${.SDATA.win@18372.4.EVENT_USERNAME}<span style="white-space:pre-wrap"> </span>application=${.SDATA.win@18372.4.EVENT_SOURCE}<span style="white-space:pre-wrap"> </span>message=${MESSAGE}\n");</div><div>};</div></div><div><br></div><div><br></div><div><br></div><div>Thanks</div><div>L:</div><div><br></div></div></div></div></div></div></div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>