-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/12/2012 06:04 PM, Evan Rempel wrote:
Does anyone have a pre build set of patterns/rewrite rule to rewrite
all cisco
logs into something that is a little more compliant?
We are trying to use a master pattern database to identify/classify messages, but the cisco logs don't have usable "program names" so the pattern database can't even get started :-(
Thanks for any pointers.
Hello :) What I usually do is to filter with something like that : filter ciscoIos { facility(local7) or (program("%PIX-[^-]+-[^-]+") or program("%ASA-[^-]+-[^-]+") or program("%FWSM-[^-]+-[^-]+")); }; then I send log back to 127.0.0.1 with cisco as program name and specifying the message field. rewrite rs_cisco { set('$PROGRAM: $MESSAGE' value("MESSAGE")); set("cisco" value("PROGRAM")); }; Hope that help you.. Seb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQeHDQAAoJEE3IBph3MKVPDrYP/ial1cK+nqY59vYiGucIX/sB dVvMNtbcbmFESNkNRhzWeVNMpv2dTOT2RzA1NbLtYA2uqDbMK5j3ltqK66q1YYNx UJ5+sUvc/t+jH7UblDkKTcgfY4uBikYNJfLNg6rljmp15xd6O60s0zJV+fdamGxw f6fR8XucVsYIdk8pS7L4/bNcYDPT+zjQp2CA1mfuvmOFJjK/k69Hh8mkNFsaWVxd prCmRqYGHBfhUv/AG1wU96y/WN1pXVhl+9lsEH9ZdreBOSQyNcEq56FcwxH/9WdX OdLQuG2YD96XrrXdjH53xb5D7rUsJp2BnavrE0+AQ8qUuDb5tVEZn+4qwoUQmiGj Qjj6cwVqYsiWLR7ReKl6XXQR9O5VIiUg42ic7D175NHFKT3dP6wBrS+GUXciesgF q6FUE8cRB+whVYXU5R/QPdgVzCdZkT7lZlkUceHAsRpjzNtjqAbxFcBSBs4171B1 jWPzFEmlViQVZm1N0Gt17s5maYaUDl06LtgEkL/pnjZpBIPwvUBMqV+4kRToFOkQ KSoqRcjqXBPHE3SrpuEI5hiySZNVr2XCb1csLLE5yfkRMCTLGDZhVLwHLxRb+IqL FPvtyxDIWB+kY/Qvbu7QdVk9b9Z5qMt6C/37Bls/5/z1Xzh4TYI57anoelcv84FG RtBdVGBJ4x4UTGE5ADD6 =OOMA -----END PGP SIGNATURE-----