Problems parsing Cisco syslogs
Hi List, I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot. So that I could see exactly what was being parsed, I disabled the default parsing using the below. source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); }; log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however. Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser? Regards, Max
I had a similar issue, could you try installing this logging configuration on your cisco devices? service timestamps log datetime msec localtime show-timezone On Tue, Feb 26, 2019 at 11:36 AM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
I have all devices configured with this exact command minus the show-timezone option and it doesn't seem to make a difference. On Tue, Feb 26, 2019 at 11:03 AM Nik Ambrosch <nik@ambrosch.com> wrote:
I had a similar issue, could you try installing this logging configuration on your cisco devices?
service timestamps log datetime msec localtime show-timezone
On Tue, Feb 26, 2019 at 11:36 AM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
You can use our docs as a guide if it helps: http://demo.logzilla.net/help/receiving_data/cisco_ios_configuration We have also encountered issues with some Cisco gear when the show-timezone command is not used (hosts will come in without a hostname, just a : instead) For example: On some Cisco IOS versions, it is imperative that this portion of the command be included. Without it, the syslog daemon may detect your device's hostname as a : instead of the actual hostname. For example: Hostname Missing 0 : 189 UTC %SYS-5-CONFIG_I: Configured from console by user1 on vty3 (192.168.2.207) Correct Hostname 0 192.168.2.252 189 UTC %SYS-5-CONFIG_I: Configured from console by user1 on vty3 (192.168.2.207) From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of "N. Pierson" <nmaxpierson@gmail.com> Reply-To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Date: Tuesday, February 26, 2019 at 12:11 PM To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: [syslog-ng] Problems parsing Cisco syslogs I have all devices configured with this exact command minus the show-timezone option and it doesn't seem to make a difference. On Tue, Feb 26, 2019 at 11:03 AM Nik Ambrosch <nik@ambrosch.com<mailto:nik@ambrosch.com>> wrote: I had a similar issue, could you try installing this logging configuration on your cisco devices? service timestamps log datetime msec localtime show-timezone On Tue, Feb 26, 2019 at 11:36 AM N. Max Pierson <nmaxpierson@gmail.com<mailto:nmaxpierson@gmail.com>> wrote: Hi List, I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot. So that I could see exactly what was being parsed, I disabled the default parsing using the below. source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); }; log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however. Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser? Regards, Max ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833373551&sdata=kulONTiXvj8%2BpodoTWbmdbvS0q5hfJjLm%2FQqmTDbe48%3D&reserved=0> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833383559&sdata=V5DC31aH0fSKIXrguQLBt0iMjAxqMbSx4hZ%2BNhZu3vI%3D&reserved=0> FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833393568&sdata=iynptNkkmdR%2FAknYSBcoWeUlFAGJuCeZxqpLlDUIVH8%3D&reserved=0> ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833393568&sdata=qvXCBbfURy%2FlNIjCLO7RNz%2BiBhMOxv4GADc6zM1VJys%3D&reserved=0> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833403576&sdata=J8iBIrYuSYmdUlMalObCFx97hKpKRCGjlRtVkvDKEg8%3D&reserved=0> FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Ccdukes%40logzilla.net%7C76fb8f1c40154b05489608d69c0d6e63%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636867978833403576&sdata=0Zfirx7WqC%2Bbzfaa3GAXR6gplKkP77J4T%2FwYE%2FWh1rg%3D&reserved=0>
Hello, When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled. Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better. Regards, Sandor On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
I looked at the existing cisco parser but did not quite understand the syntax. I also tried pattern-db but I could not get that to work either. Is it recommended to use pattern-db or should I try and copy the default parser and start from there? I'll post my pattern-db xml file if it's recommended to use it instead of the default parser. Regards, Max On Tue, Feb 26, 2019 at 11:08 AM Sandor Geller <sandor.geller@ericsson.com> wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it. Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated. You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl). On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
The cisco-parser works for almost all IOS messages but does not work for NX-OS messages. I also will need to test IOS-XR messages to see if there's any variance there as I have those in my network as well, just haven't had a chance to setup syslog yet. I will give the scl library a good look at and see if I can make sense of it but I think you have given me enough info to try and start that way. thanks, max On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Balázs, I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them. Regards, Max On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Log samples would be appreciated. On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858 NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times Regards, Max On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already. On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
The 2 samples that I sent were recorded with the no-parse option on the network source and sent to a file destination with no other options specified. Is this what you need or do you need the raw message itself? If you need the raw message itself, how do I get that (configuration wise)? I thought the no parse option gave you the raw message minus the headers. Regards, Max On Sat, Mar 2, 2019 at 2:37 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd. Do all messages from the same device look the same? Or these are just the exceptions? Also what is nxos? On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
On Mon, Mar 4, 2019 at 2:01 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
The OS for Nexus gear. https://en.wikipedia.org/wiki/Cisco_NX-OS -m
I have found a couple of cases where NXOS and IOS messages do not contain the mnemonic. And the tracebacks do not contain a timestamp at all. I should also mention that I have keep_hostname and keep_timestamp set to off however the traceback message doesn't contain a timestamp in either case. There is also an instance where a specific log is wrapped into a new message due to length I'm guessing and doesn't contain the mnemonic and the actual message portion of the log starts with several spaces before the text. And NXOS doesn't seem to have a seq number after the <###> start of the message. Having all of this said, is there a way to write at the end of those if statements that takes anything that isn't matched past the <###> and still logs it so that it isn't dropped (or anything that doesn't match the triplet)? If I understood all of the elements in the plugin.conf file I would gladly write it myself but there are several things in that file that I do not understand. Is there any documentation on the block statements and logic that I can look at to help me out? Regards, Max On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
> Hello, > > When the no-parse flag is used then the macros referencing various > parts of the message aren't filled in. HOST could get looked up using a > reverse DNS lookup unless the keep_hostname option is set. The syslog > priority is set to user.notice when parsing is disabled. > > Did you take a look at the existing cisco parser? Using it or > adopting it should ease your job. If you could configure the Ciscos to use > other port than anything else (which speaks syslog, Cisco devices usually > aren't such...) would be even better. > > Regards, > Sandor > > On 02/26/2019 05:36 PM, N. Max Pierson wrote: > > Hi List, > > I have been trying to get something in place that can parse syslogs > from various Cisco devices. The message format is almost the same with a > few exceptions. Here is what I have tried and it works but now it has > created another problem I do not know how to troubleshoot. > > So that I could see exactly what was being parsed, I disabled the > default parsing using the below. > > source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; > > rewrite r_cisco{ > subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', > "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; > > destination d_mysql { > sql(type(mysql) > host("127.0.0.1") > username("syslog-ng") > password("password") > database("syslog") > table("messages_${HOST}") > columns("datetime datetime", "host varchar(50)", "level > varchar(10)", "message text") > values("${R_YEAR}-${R_MONTH}-${R_DAY} > ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") > indexes("datetime", "level") > ); > }; > > log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; > > This works perfectly as it formats the message as I want and covers > IOS and NX-OS devices. The problem is when I turned off the default parser, > now all of my logs show "notice" in the $LEVEL macro and doesn't reflect > the real message header level. The $HOST macro still works fine however. > > Is this the expected behavior that the message header fields are not > parsed as well as the $MESSAGE itself not being parsed? How can map the > header level field properly to the $LEVEL marco if I disable the default > parser? > > Regards, > Max > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Balázs,, I have decided to not worry about anything without the cisco mnemonic and use the cisco parser until I can come up with a better solution. I made that modification to the plugin.conf file and now I am able to receive NX-OS messages but I have discovered an issue that seems to be with the cisco parser itself. When I enable it, all of my messages are coming in with a "notice" level so it seems as though the cisco parser isn't properly parsing the header correctly. I even moved back to the default plugin.conf file to make sure my modifications didn't break it in the process. Here is my config if that helps..... source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${LEVEL} ${MESSAGE}\n"); }; destination d_test { file("/var/log/network-test" template(t_cisco)); }; parser p_cisco { cisco-parser(); }; log { source(s_network); parser(p_cisco); destination(d_test); }; Regards, Max On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com wrote:
> Hello, > > When the no-parse flag is used then the macros referencing various > parts of the message aren't filled in. HOST could get looked up using a > reverse DNS lookup unless the keep_hostname option is set. The syslog > priority is set to user.notice when parsing is disabled. > > Did you take a look at the existing cisco parser? Using it or > adopting it should ease your job. If you could configure the Ciscos to use > other port than anything else (which speaks syslog, Cisco devices usually > aren't such...) would be even better. > > Regards, > Sandor > > On 02/26/2019 05:36 PM, N. Max Pierson wrote: > > Hi List, > > I have been trying to get something in place that can parse syslogs > from various Cisco devices. The message format is almost the same with a > few exceptions. Here is what I have tried and it works but now it has > created another problem I do not know how to troubleshoot. > > So that I could see exactly what was being parsed, I disabled the > default parsing using the below. > > source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; > > rewrite r_cisco{ > subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', > "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; > > destination d_mysql { > sql(type(mysql) > host("127.0.0.1") > username("syslog-ng") > password("password") > database("syslog") > table("messages_${HOST}") > columns("datetime datetime", "host varchar(50)", "level > varchar(10)", "message text") > values("${R_YEAR}-${R_MONTH}-${R_DAY} > ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") > indexes("datetime", "level") > ); > }; > > log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; > > This works perfectly as it formats the message as I want and covers > IOS and NX-OS devices. The problem is when I turned off the default parser, > now all of my logs show "notice" in the $LEVEL macro and doesn't reflect > the real message header level. The $HOST macro still works fine however. > > Is this the expected behavior that the message header fields are not > parsed as well as the $MESSAGE itself not being parsed? How can map the > header level field properly to the $LEVEL marco if I disable the default > parser? > > Regards, > Max > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hello, The *cisco-parser* as of now cannot set the LEVEL macro, as that is a *hard* macro, those cannot be set directly from configuration setters (for example: rewrite { set("lvl" value("LEVEL"); };). The header is parsed into the ".prefix.*" macros, the default *prefix* is ".cisco.". I think with shifting *parser*s implemented as syslog-ng configuration rather then C, it might be a good idea to lift the soft vs hard macro via a proper setters. Note1: if you are using *flags(no-parse)* it is going to set a default level, changing at least that default level is possible per source "network( default_level(...) flags(no-parse) ...);" Note2: if you really want to set LEVEL macro, well you can do it but not by design, and it might break at any point. It is possible to shadow hard macros setting patterns, instead of LEVEL you could set LEVLE[L] pattern, well which is kinda only matches LEVEL anyway. The way it works it creates a LEVEL soft macro. IMPORTANT: this leaves the message in a semi-state, as some code is going to use ${LEVEL} and some code is going to use the internal level representation which still stays the same old level. -- Kokan On Wed, Mar 6, 2019 at 9:45 PM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Balázs,,
I have decided to not worry about anything without the cisco mnemonic and use the cisco parser until I can come up with a better solution. I made that modification to the plugin.conf file and now I am able to receive NX-OS messages but I have discovered an issue that seems to be with the cisco parser itself. When I enable it, all of my messages are coming in with a "notice" level so it seems as though the cisco parser isn't properly parsing the header correctly. I even moved back to the default plugin.conf file to make sure my modifications didn't break it in the process. Here is my config if that helps.....
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${LEVEL} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
parser p_cisco { cisco-parser(); };
log { source(s_network); parser(p_cisco); destination(d_test); };
Regards, Max
On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
> The cisco-parser() should take care about messages from cisco > routers assuming they were received using flags(no-parse). It will > automatically detect timestamp formats, but its not perfect, so if you > encounter something that it doesn't properly parse, do let us know, so we > can add it. > > Also, default-network-drivers() makes it possible to receive both > cisco and non-cisco logs on the same port, automatically recognizing the > appropriate format. This driver relies on the app-parser() framework, which > can be extended by application specific parsers. With that you can > construct your specific source driver configuration if you find > default-network-drivers () too complicated. > > You can find all of these in the documentation, and their source in > the syslog-ng configuration library (scl for short, usually in > /usr/share/syslog-ng/include/scl). > > On Tue, Feb 26, 2019, 18:08 Sandor Geller < > sandor.geller@ericsson.com wrote: > >> Hello, >> >> When the no-parse flag is used then the macros referencing various >> parts of the message aren't filled in. HOST could get looked up using a >> reverse DNS lookup unless the keep_hostname option is set. The syslog >> priority is set to user.notice when parsing is disabled. >> >> Did you take a look at the existing cisco parser? Using it or >> adopting it should ease your job. If you could configure the Ciscos to use >> other port than anything else (which speaks syslog, Cisco devices usually >> aren't such...) would be even better. >> >> Regards, >> Sandor >> >> On 02/26/2019 05:36 PM, N. Max Pierson wrote: >> >> Hi List, >> >> I have been trying to get something in place that can parse syslogs >> from various Cisco devices. The message format is almost the same with a >> few exceptions. Here is what I have tried and it works but now it has >> created another problem I do not know how to troubleshoot. >> >> So that I could see exactly what was being parsed, I disabled the >> default parsing using the below. >> >> source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; >> >> rewrite r_cisco{ >> subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', >> "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; >> >> destination d_mysql { >> sql(type(mysql) >> host("127.0.0.1") >> username("syslog-ng") >> password("password") >> database("syslog") >> table("messages_${HOST}") >> columns("datetime datetime", "host varchar(50)", "level >> varchar(10)", "message text") >> values("${R_YEAR}-${R_MONTH}-${R_DAY} >> ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") >> indexes("datetime", "level") >> ); >> }; >> >> log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; >> >> This works perfectly as it formats the message as I want and covers >> IOS and NX-OS devices. The problem is when I turned off the default parser, >> now all of my logs show "notice" in the $LEVEL macro and doesn't reflect >> the real message header level. The $HOST macro still works fine however. >> >> Is this the expected behavior that the message header fields are >> not parsed as well as the $MESSAGE itself not being parsed? How can map the >> header level field properly to the $LEVEL marco if I disable the default >> parser? >> >> Regards, >> Max >> >> >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi Kokan, I didn't catch that previously, so thanks for pointing that out for me. I made the changes to reflect the ${.cisco.severity} macro but now I am not getting anything in my database table. It seems to work if I log it to a file, but for some reason when I log to mysql, it doesn't put anything in the column I had for level. My config is below. Also, is there any way to show the text version of the severity instead of the number? source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${.cisco.severity} ${MESSAGE}\n"); }; destination d_test { file("/var/log/network-test" template(t_cisco)); }; destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${.cisco.severity}", "${MESSAGE}") indexes("datetime", "level") ); }; log { source(s_network); parser(p_cisco); destination(d_test); }; log { source(s_network); parser(p_cisco); destination(d_mysql); }; Regards, Max On Thu, Mar 7, 2019 at 1:50 AM Péter, Kókai <peter.kokai@oneidentity.com> wrote:
Hello,
The *cisco-parser* as of now cannot set the LEVEL macro, as that is a *hard* macro, those cannot be set directly from configuration setters (for example: rewrite { set("lvl" value("LEVEL"); };). The header is parsed into the ".prefix.*" macros, the default *prefix* is ".cisco.".
I think with shifting *parser*s implemented as syslog-ng configuration rather then C, it might be a good idea to lift the soft vs hard macro via a proper setters.
Note1: if you are using *flags(no-parse)* it is going to set a default level, changing at least that default level is possible per source "network( default_level(...) flags(no-parse) ...);"
Note2: if you really want to set LEVEL macro, well you can do it but not by design, and it might break at any point. It is possible to shadow hard macros setting patterns, instead of LEVEL you could set LEVLE[L] pattern, well which is kinda only matches LEVEL anyway. The way it works it creates a LEVEL soft macro. IMPORTANT: this leaves the message in a semi-state, as some code is going to use ${LEVEL} and some code is going to use the internal level representation which still stays the same old level.
-- Kokan
On Wed, Mar 6, 2019 at 9:45 PM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Balázs,,
I have decided to not worry about anything without the cisco mnemonic and use the cisco parser until I can come up with a better solution. I made that modification to the plugin.conf file and now I am able to receive NX-OS messages but I have discovered an issue that seems to be with the cisco parser itself. When I enable it, all of my messages are coming in with a "notice" level so it seems as though the cisco parser isn't properly parsing the header correctly. I even moved back to the default plugin.conf file to make sure my modifications didn't break it in the process. Here is my config if that helps.....
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${LEVEL} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
parser p_cisco { cisco-parser(); };
log { source(s_network); parser(p_cisco); destination(d_test); };
Regards, Max
On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com wrote:
> Balázs, > > I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S > - added lines 62-65) for the cisco-parser and I was able to capture NX-OS > syslogs. I also noticed that the default parser is not matching syslogs > that do not include the Cisco mnemonic (both for IOS and NX-OS). While I > was able to fix the NX-OS issues (which was a date parsing problem), i'm > not sure what needs to be changed/added in this file so that even logs that > do not contain the mnemonic are matched. Can anyone shed some light on what > part of this parser needs to be changed to resolve the issue? I can post > some examples of a log that doesn't contain the mnemonic should you need > them. > > Regards, > Max > > On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < > balazs.scheidler@oneidentity.com> wrote: > >> The cisco-parser() should take care about messages from cisco >> routers assuming they were received using flags(no-parse). It will >> automatically detect timestamp formats, but its not perfect, so if you >> encounter something that it doesn't properly parse, do let us know, so we >> can add it. >> >> Also, default-network-drivers() makes it possible to receive both >> cisco and non-cisco logs on the same port, automatically recognizing the >> appropriate format. This driver relies on the app-parser() framework, which >> can be extended by application specific parsers. With that you can >> construct your specific source driver configuration if you find >> default-network-drivers () too complicated. >> >> You can find all of these in the documentation, and their source in >> the syslog-ng configuration library (scl for short, usually in >> /usr/share/syslog-ng/include/scl). >> >> On Tue, Feb 26, 2019, 18:08 Sandor Geller < >> sandor.geller@ericsson.com wrote: >> >>> Hello, >>> >>> When the no-parse flag is used then the macros referencing various >>> parts of the message aren't filled in. HOST could get looked up using a >>> reverse DNS lookup unless the keep_hostname option is set. The syslog >>> priority is set to user.notice when parsing is disabled. >>> >>> Did you take a look at the existing cisco parser? Using it or >>> adopting it should ease your job. If you could configure the Ciscos to use >>> other port than anything else (which speaks syslog, Cisco devices usually >>> aren't such...) would be even better. >>> >>> Regards, >>> Sandor >>> >>> On 02/26/2019 05:36 PM, N. Max Pierson wrote: >>> >>> Hi List, >>> >>> I have been trying to get something in place that can parse >>> syslogs from various Cisco devices. The message format is almost the same >>> with a few exceptions. Here is what I have tried and it works but now it >>> has created another problem I do not know how to troubleshoot. >>> >>> So that I could see exactly what was being parsed, I disabled the >>> default parsing using the below. >>> >>> source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; >>> >>> rewrite r_cisco{ >>> subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', >>> "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; >>> >>> destination d_mysql { >>> sql(type(mysql) >>> host("127.0.0.1") >>> username("syslog-ng") >>> password("password") >>> database("syslog") >>> table("messages_${HOST}") >>> columns("datetime datetime", "host varchar(50)", "level >>> varchar(10)", "message text") >>> values("${R_YEAR}-${R_MONTH}-${R_DAY} >>> ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") >>> indexes("datetime", "level") >>> ); >>> }; >>> >>> log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; >>> >>> This works perfectly as it formats the message as I want and >>> covers IOS and NX-OS devices. The problem is when I turned off the default >>> parser, now all of my logs show "notice" in the $LEVEL macro and doesn't >>> reflect the real message header level. The $HOST macro still works fine >>> however. >>> >>> Is this the expected behavior that the message header fields are >>> not parsed as well as the $MESSAGE itself not being parsed? How can map the >>> header level field properly to the $LEVEL marco if I disable the default >>> parser? >>> >>> Regards, >>> Max >>> >>> >>> >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >>> >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hello, There are a few ways you could achieve that, but neither of them is built directly to handle *severity*; in a sense that they are general text handling options. Option1: (the slowest one) use *if* - *elif* - *else* chain match/set (You can see a few example in scl) Option2: (I would recommend this option) add-contextual-data , this provides a way to enrich the logs based on a csv Option3: (This is really risky) I've created a PR ( https://github.com/balabit/syslog-ng/pull/2602) "fixing" the level value of level macro with *cisco-parser*, with this patch it should set the *.cisco.severity* so you could use the old macros Please not that for the last option you have to compile syslog-ng yourself, and there is no guarantee that it is going to be upstreamed at all. Note: there are possible other ways with template as well. -- Kokan On Thu, Mar 7, 2019 at 8:22 PM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Hi Kokan,
I didn't catch that previously, so thanks for pointing that out for me. I made the changes to reflect the ${.cisco.severity} macro but now I am not getting anything in my database table. It seems to work if I log it to a file, but for some reason when I log to mysql, it doesn't put anything in the column I had for level. My config is below. Also, is there any way to show the text version of the severity instead of the number?
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${.cisco.severity} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${.cisco.severity}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); parser(p_cisco); destination(d_test); };
log { source(s_network); parser(p_cisco); destination(d_mysql); };
Regards, Max
On Thu, Mar 7, 2019 at 1:50 AM Péter, Kókai <peter.kokai@oneidentity.com> wrote:
Hello,
The *cisco-parser* as of now cannot set the LEVEL macro, as that is a *hard* macro, those cannot be set directly from configuration setters (for example: rewrite { set("lvl" value("LEVEL"); };). The header is parsed into the ".prefix.*" macros, the default *prefix* is ".cisco.".
I think with shifting *parser*s implemented as syslog-ng configuration rather then C, it might be a good idea to lift the soft vs hard macro via a proper setters.
Note1: if you are using *flags(no-parse)* it is going to set a default level, changing at least that default level is possible per source "network( default_level(...) flags(no-parse) ...);"
Note2: if you really want to set LEVEL macro, well you can do it but not by design, and it might break at any point. It is possible to shadow hard macros setting patterns, instead of LEVEL you could set LEVLE[L] pattern, well which is kinda only matches LEVEL anyway. The way it works it creates a LEVEL soft macro. IMPORTANT: this leaves the message in a semi-state, as some code is going to use ${LEVEL} and some code is going to use the internal level representation which still stays the same old level.
-- Kokan
On Wed, Mar 6, 2019 at 9:45 PM N. Max Pierson <nmaxpierson@gmail.com> wrote:
Balázs,,
I have decided to not worry about anything without the cisco mnemonic and use the cisco parser until I can come up with a better solution. I made that modification to the plugin.conf file and now I am able to receive NX-OS messages but I have discovered an issue that seems to be with the cisco parser itself. When I enable it, all of my messages are coming in with a "notice" level so it seems as though the cisco parser isn't properly parsing the header correctly. I even moved back to the default plugin.conf file to make sure my modifications didn't break it in the process. Here is my config if that helps.....
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${LEVEL} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
parser p_cisco { cisco-parser(); };
log { source(s_network); parser(p_cisco); destination(d_test); };
Regards, Max
On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs < balazs.scheidler@oneidentity.com wrote:
Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com wrote:
Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs < balazs.scheidler@oneidentity.com> wrote:
> Log samples would be appreciated. > > On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com > wrote: > >> Balázs, >> >> I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S >> - added lines 62-65) for the cisco-parser and I was able to capture NX-OS >> syslogs. I also noticed that the default parser is not matching syslogs >> that do not include the Cisco mnemonic (both for IOS and NX-OS). While I >> was able to fix the NX-OS issues (which was a date parsing problem), i'm >> not sure what needs to be changed/added in this file so that even logs that >> do not contain the mnemonic are matched. Can anyone shed some light on what >> part of this parser needs to be changed to resolve the issue? I can post >> some examples of a log that doesn't contain the mnemonic should you need >> them. >> >> Regards, >> Max >> >> On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs < >> balazs.scheidler@oneidentity.com> wrote: >> >>> The cisco-parser() should take care about messages from cisco >>> routers assuming they were received using flags(no-parse). It will >>> automatically detect timestamp formats, but its not perfect, so if you >>> encounter something that it doesn't properly parse, do let us know, so we >>> can add it. >>> >>> Also, default-network-drivers() makes it possible to receive both >>> cisco and non-cisco logs on the same port, automatically recognizing the >>> appropriate format. This driver relies on the app-parser() framework, which >>> can be extended by application specific parsers. With that you can >>> construct your specific source driver configuration if you find >>> default-network-drivers () too complicated. >>> >>> You can find all of these in the documentation, and their source >>> in the syslog-ng configuration library (scl for short, usually in >>> /usr/share/syslog-ng/include/scl). >>> >>> On Tue, Feb 26, 2019, 18:08 Sandor Geller < >>> sandor.geller@ericsson.com wrote: >>> >>>> Hello, >>>> >>>> When the no-parse flag is used then the macros referencing >>>> various parts of the message aren't filled in. HOST could get looked up >>>> using a reverse DNS lookup unless the keep_hostname option is set. The >>>> syslog priority is set to user.notice when parsing is disabled. >>>> >>>> Did you take a look at the existing cisco parser? Using it or >>>> adopting it should ease your job. If you could configure the Ciscos to use >>>> other port than anything else (which speaks syslog, Cisco devices usually >>>> aren't such...) would be even better. >>>> >>>> Regards, >>>> Sandor >>>> >>>> On 02/26/2019 05:36 PM, N. Max Pierson wrote: >>>> >>>> Hi List, >>>> >>>> I have been trying to get something in place that can parse >>>> syslogs from various Cisco devices. The message format is almost the same >>>> with a few exceptions. Here is what I have tried and it works but now it >>>> has created another problem I do not know how to troubleshoot. >>>> >>>> So that I could see exactly what was being parsed, I disabled the >>>> default parsing using the below. >>>> >>>> source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; >>>> >>>> rewrite r_cisco{ >>>> subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', >>>> "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; >>>> >>>> destination d_mysql { >>>> sql(type(mysql) >>>> host("127.0.0.1") >>>> username("syslog-ng") >>>> password("password") >>>> database("syslog") >>>> table("messages_${HOST}") >>>> columns("datetime datetime", "host varchar(50)", "level >>>> varchar(10)", "message text") >>>> values("${R_YEAR}-${R_MONTH}-${R_DAY} >>>> ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") >>>> indexes("datetime", "level") >>>> ); >>>> }; >>>> >>>> log { source(s_network); rewrite(r_cisco); destination(d_mysql); >>>> }; >>>> >>>> This works perfectly as it formats the message as I want and >>>> covers IOS and NX-OS devices. The problem is when I turned off the default >>>> parser, now all of my logs show "notice" in the $LEVEL macro and doesn't >>>> reflect the real message header level. The $HOST macro still works fine >>>> however. >>>> >>>> Is this the expected behavior that the message header fields are >>>> not parsed as well as the $MESSAGE itself not being parsed? How can map the >>>> header level field properly to the $LEVEL marco if I disable the default >>>> parser? >>>> >>>> Regards, >>>> Max >>>> >>>> >>>> >>>> ______________________________________________________________________________ >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> >>>> >>>> >>>> ______________________________________________________________________________ >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> Documentation: >>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> >>>> >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Thanks Kokan for the options. I’ll start with the add-contextual-data option first and go from there. Regards, Max
On Mar 8, 2019, at 1:49 AM, Péter, Kókai <peter.kokai@oneidentity.com> wrote:
Hello,
There are a few ways you could achieve that, but neither of them is built directly to handle *severity*; in a sense that they are general text handling options.
Option1: (the slowest one) use *if* - *elif* - *else* chain match/set (You can see a few example in scl) Option2: (I would recommend this option) add-contextual-data , this provides a way to enrich the logs based on a csv Option3: (This is really risky) I've created a PR (https://github.com/balabit/syslog-ng/pull/2602 <https://github.com/balabit/syslog-ng/pull/2602>) "fixing" the level value of level macro with *cisco-parser*, with this patch it should set the *.cisco.severity* so you could use the old macros
Please not that for the last option you have to compile syslog-ng yourself, and there is no guarantee that it is going to be upstreamed at all.
Note: there are possible other ways with template as well.
-- Kokan
On Thu, Mar 7, 2019 at 8:22 PM N. Max Pierson <nmaxpierson@gmail.com <mailto:nmaxpierson@gmail.com>> wrote: Hi Kokan,
I didn't catch that previously, so thanks for pointing that out for me. I made the changes to reflect the ${.cisco.severity} macro but now I am not getting anything in my database table. It seems to work if I log it to a file, but for some reason when I log to mysql, it doesn't put anything in the column I had for level. My config is below. Also, is there any way to show the text version of the severity instead of the number?
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${.cisco.severity} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${.cisco.severity}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); parser(p_cisco); destination(d_test); };
log { source(s_network); parser(p_cisco); destination(d_mysql); };
Regards, Max
On Thu, Mar 7, 2019 at 1:50 AM Péter, Kókai <peter.kokai@oneidentity.com <mailto:peter.kokai@oneidentity.com>> wrote: Hello,
The *cisco-parser* as of now cannot set the LEVEL macro, as that is a *hard* macro, those cannot be set directly from configuration setters (for example: rewrite { set("lvl" value("LEVEL"); };). The header is parsed into the ".prefix.*" macros, the default *prefix* is ".cisco.".
I think with shifting *parser*s implemented as syslog-ng configuration rather then C, it might be a good idea to lift the soft vs hard macro via a proper setters.
Note1: if you are using *flags(no-parse)* it is going to set a default level, changing at least that default level is possible per source "network( default_level(...) flags(no-parse) ...);"
Note2: if you really want to set LEVEL macro, well you can do it but not by design, and it might break at any point. It is possible to shadow hard macros setting patterns, instead of LEVEL you could set LEVLE[L] pattern, well which is kinda only matches LEVEL anyway. The way it works it creates a LEVEL soft macro. IMPORTANT: this leaves the message in a semi-state, as some code is going to use ${LEVEL} and some code is going to use the internal level representation which still stays the same old level.
-- Kokan
On Wed, Mar 6, 2019 at 9:45 PM N. Max Pierson <nmaxpierson@gmail.com <mailto:nmaxpierson@gmail.com>> wrote: Balázs,,
I have decided to not worry about anything without the cisco mnemonic and use the cisco parser until I can come up with a better solution. I made that modification to the plugin.conf file and now I am able to receive NX-OS messages but I have discovered an issue that seems to be with the cisco parser itself. When I enable it, all of my messages are coming in with a "notice" level so it seems as though the cisco parser isn't properly parsing the header correctly. I even moved back to the default plugin.conf file to make sure my modifications didn't break it in the process. Here is my config if that helps.....
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
template t_cisco { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${HOST} ${LEVEL} ${MESSAGE}\n"); };
destination d_test { file("/var/log/network-test" template(t_cisco)); };
parser p_cisco { cisco-parser(); };
log { source(s_network); parser(p_cisco); destination(d_test); };
Regards, Max
On Mon, Mar 4, 2019 at 2:00 PM Scheidler, Balázs <balazs.scheidler@oneidentity.com <mailto:balazs.scheidler@oneidentity.com>> wrote: It was a bit strange that nxos starts with a colon and that a cisco message didn't have a mnemonic. Cisco messages by my experience always contain a triplet and this one isn't, and doesn't seem to have a timestamp either. If you say that this was recorded the way you mentioned then i believe you :), they just looked a bit odd.
Do all messages from the same device look the same? Or these are just the exceptions?
Also what is nxos?
On Sat, Mar 2, 2019, 21:37 Scheidler, Balázs <balazs.scheidler@oneidentity.com <mailto:balazs.scheidler@oneidentity.com> wrote: Can you please include the log sample as it was received by syslog-ng? This seems to have been mangled already.
On Fri, Mar 1, 2019, 23:16 N. Max Pierson <nmaxpierson@gmail.com <mailto:nmaxpierson@gmail.com> wrote: Here are 2 different samples of logs without the mnemonic, one is IOS and the other is NX-OS
IOS, no-parse log to file -- Mar 1 16:06:07 hostname1 <185>78919861: -Traceback= 151644C 151763C 17F0094 1B8BDE8 1B82858
NX-OS, no-parse log to file -- Mar 1 16:10:41 hostname1 <189>: 2019 Mar 1 16:10:41 CST: last message repeated 3 times
Regards, Max
On Thu, Feb 28, 2019 at 5:45 PM Scheidler, Balázs <balazs.scheidler@oneidentity.com <mailto:balazs.scheidler@oneidentity.com>> wrote: Log samples would be appreciated.
On Thu, Feb 28, 2019, 18:11 N. Max Pierson <nmaxpierson@gmail.com <mailto:nmaxpierson@gmail.com> wrote: Balázs,
I modified the plugin.conf XML file (https://pastebin.com/9BruYy0S <https://pastebin.com/9BruYy0S> - added lines 62-65) for the cisco-parser and I was able to capture NX-OS syslogs. I also noticed that the default parser is not matching syslogs that do not include the Cisco mnemonic (both for IOS and NX-OS). While I was able to fix the NX-OS issues (which was a date parsing problem), i'm not sure what needs to be changed/added in this file so that even logs that do not contain the mnemonic are matched. Can anyone shed some light on what part of this parser needs to be changed to resolve the issue? I can post some examples of a log that doesn't contain the mnemonic should you need them.
Regards, Max
On Tue, Feb 26, 2019 at 11:14 AM Scheidler, Balázs <balazs.scheidler@oneidentity.com <mailto:balazs.scheidler@oneidentity.com>> wrote: The cisco-parser() should take care about messages from cisco routers assuming they were received using flags(no-parse). It will automatically detect timestamp formats, but its not perfect, so if you encounter something that it doesn't properly parse, do let us know, so we can add it.
Also, default-network-drivers() makes it possible to receive both cisco and non-cisco logs on the same port, automatically recognizing the appropriate format. This driver relies on the app-parser() framework, which can be extended by application specific parsers. With that you can construct your specific source driver configuration if you find default-network-drivers () too complicated.
You can find all of these in the documentation, and their source in the syslog-ng configuration library (scl for short, usually in /usr/share/syslog-ng/include/scl).
On Tue, Feb 26, 2019, 18:08 Sandor Geller <sandor.geller@ericsson.com <mailto:sandor.geller@ericsson.com> wrote: Hello,
When the no-parse flag is used then the macros referencing various parts of the message aren't filled in. HOST could get looked up using a reverse DNS lookup unless the keep_hostname option is set. The syslog priority is set to user.notice when parsing is disabled.
Did you take a look at the existing cisco parser? Using it or adopting it should ease your job. If you could configure the Ciscos to use other port than anything else (which speaks syslog, Cisco devices usually aren't such...) would be even better.
Regards, Sandor
On 02/26/2019 05:36 PM, N. Max Pierson wrote:
Hi List,
I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot.
So that I could see exactly what was being parsed, I disabled the default parsing using the below.
source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); };
rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); };
destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); };
log { source(s_network); rewrite(r_cisco); destination(d_mysql); };
This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however.
Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser?
Regards, Max
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq>
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (7)
-
Clayton Dukes
-
Matt Zagrabelny
-
N. Max Pierson
-
Nik Ambrosch
-
Péter, Kókai
-
Sandor Geller
-
Scheidler, Balázs