I am setting up some patterns to parse Cisco syslog messages. I noticed that pdbtool will not complete if I have a "%F" anywhere in the string.
Example log message:
This does not complete:
pdbtool match -p cisco.xml -M "%FWSM-1-109006: Authentication failed for user 'test' from
131.212.1.1/43250 to
10.1.1.1/22 on interface management"
Nor does simply %F:
pdbtool match -p cisco.xml -M "%F"
It is fine without the %:
pdbtool match -p cisco.xml -M "FWSM-1-109006: Authentication failed for user 'test' from
131.212.1.1/43250 to
10.1.1.1/22 on interface management"
.classifier.class=login
.classifier.rule_id=5cfbcb23-cfe4-4120-85c1-918df65c0edc
usracct.username=test
usracct.device=131.212.1.1
usracct.service=22
usracct.type=login
usracct.sessionid=
usracct.application=
secevt.verdict=REJECT
TAGS=.classifier.login,usracct,secevt
It also seems to have issues with "%S", although not quite in the same way. Any ideas what could be causing this?
Mark
--
Mark Shetka
Information Technology Systems & Services
University of Minnesota - Duluth
(218) 726-7682