[syslog-ng] Pattern matching.

[Balazs Scheidler]

On Thu, 2011-12-22 at 14:31 +0530, Anup Shetty wrote:
> Nope, no luck yet. Still blanks being spit out. 
> 
> 
> Here's the exact extract of the pattern matching and the log:
> 
> 
> Pattern String
> ---------------------------
> 
> 
> @ESTRING:user::@ Security Microsoft Windows security auditing.:
> [Success Audit] A computer account was changed.    Subject:   Security
> ID:  S-1-5-7   Account Name:  ANONYMOUS LOGON   Account Domain:  NT
> AUTHORITY   Logon ID:  0x3e6    Computer Account That Was Changed:
> Security ID:  @ESTRING::  @Account Name:   @ESTRING:ACC_NAME: @
> Account Domain:  WW002    Changed Attributes:   SAM Account Name: -
> Display Name:  -   User Principal Name: -   Home Directory:  -   Home
> Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -
> Password Last Set: @ESTRING:: @@ESTRING:: @   Account Expires:  -
> Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  -   New
> UAC Value:  -   User Account Control: -   User Parameters: -   SID
> History:  -   Logon Hours:  -   DNS Host Name:  -   Service Principal
> Names: -    Additional Information:   Privileges:  - (EventID 4742)
> 
> 
> Log
> ------------------
> 
> 
> Dec 22 03:38:32 Server.zoom11.test.net
> Microsoft_Windows_security_auditing.[5784]: : Security Microsoft
> Windows security auditing.: [Success Audit] A computer account was
> changed.    Subject:   Security ID:  S-1-5-7   Account Name:
>  ANONYMOUS LOGON   Account Domain:  NT AUTHORITY   Logon ID:  0x3e6
>  Computer Account That Was Changed:   Security ID:
>  S-1-5-21-776561741-789336058-725345543-305444   Account Name:  User1$
> Account Domain:  TEST    Changed Attributes:   SAM Account Name: -
> Display Name:  -   User Principal Name: -   Home Directory:  -   Home
> Drive:  -   Script Path:  -   Profile Path:  -   User Workstations: -
> Password Last Set: 12/22/2011 3:38:32 AM   Account Expires:  -
> Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value:  -   New
> UAC Value:  -   User Account Control: -   User Parameters: -   SID
> History:  -   Logon Hours:  -   DNS Host Name:  -   Service Principal
> Names: -    Additional Information:   Privileges:  - (EventID 4742)
> 
> 
"pdbtool match" can be used to test patterns.

pdbtool patch -p <path to xml file> -P '<appname>' -M '<msg>' --debug --color-out

This even colours the output so that the partial matches can be
recognized. This is the best way to troubleshoot patterns.

-- 
Bazsi