[syslog-ng] in-list syntax

[Clayton Dukes]

Hey Peter, I just happened to see this email. Nice work!
One side note: the `*` in a timestamp from Cisco indicates a problem with NTP on that host. So only some message may have that.
Here's a paper I wrote when I worked at Cisco that describes this (and more):

http://www.cisco.com/c/en/us/products/collateral/services/high-availability/white_paper_c11-557812.html#wp9000331



[cid:image001.png at 01D2FEE7.CDFE20D0]


From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> on behalf of "Czanik, Péter" <peter.czanik at balabit.com>
Reply-To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Date: Monday, July 17, 2017 at 6:51 AM
To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] in-list syntax

Hi,

If you use syslog-ng 3.10 you can give the cisco parser a try: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#cisco-parser It parses Cisco log messages (at least a good part of them) and creates name-value pairs from them.

If 3.10 is not an option for you, first I'd check if the PROGRAM macro really contains the information you are looking for. I usually do that using the format-json template with "--scope everything". It gives a lot more information than necessary, but still the quickest way to figure it out.

Or even better: use the Cisco parser for hints how to parse necessary information from logs. It is actually configuration snippet (SCL) and you can browse it on-line: https://github.com/balabit/syslog-ng/blob/master/scl/cisco/plugin.conf
Bye,

Peter Czanik (CzP) <peter.czanik at balabit.com<mailto:peter.czanik at balabit.com>>
Balabit / syslog-ng upstream
https://www.balabit.com/blog/author/peterczanik/
https://twitter.com/PCzanik

On Thu, Jul 13, 2017 at 4:07 PM, Damian Bell <Damian.Bell at clarksons.com<mailto:Damian.Bell at clarksons.com>> wrote:

Hello,

I’ve previously had a very simple regex list configured for Cisco ASA devices to deliver email alerts on routing changes in our network, which was configured thus:-

filter f_sev1 { match("%ASA-3-622001"); };

…which works just fine. Wanting to expand this list a bit, and aware that scaling regex matching up is going to incur performance issues, I’ve thought that an “in-list” expression file might have been a better approach, and as such have configured the following:-

filter f_sev1 { in-list("/etc/syslog-ng/email-match-list.list", value("PROGRAM")); };

…where “PROGRAM” is (I believe) the applicable part of the code that matches to the Cisco "%ASA-3-622001" part of the message. The whitelist has the following entries (as an example):-

%DUAL-5-NBRCHANGE
%ASA-3-622001
%SPANTREE-5-TOPOTRAP
%SPANTREE-5-ROOTCHANGE
%ASA-5-111010

I am not getting any matches here, however. What am I missing?

Thanks very much in advance,

Damian

Damian Bell
Infrastructure Engineer | Support | H Clarkson & Co Ltd

T: +44 20 7334 5483<tel:+44%2020%207334%205483>
Email: Damian.Bell at clarksons.com<mailto:Damian.Bell at clarksons.com>
Group Email: infrastructure at clarksons.com<mailto:infrastructure at clarksons.com>

Clarksons Platou  TM
Commodity Quay, St. Katharine Docks | London E1W 1BF | United Kingdom
www.clarksons.com<http://www.clarksons.com>

Please consider the environment before printing this e-mail



________________________________
This message is private and confidential. If you have received it in error, you are on notice of its status. Please notify us immediately by reply email and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person: to do so could be a breach of confidence.

Emails may be monitored.

Details of Clarkson group companies and their regulators (where applicable) can be found at this url: Disclosure<http://www.clarksons.com/disclosure/>
________________________________

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170717/c3d5e4ff/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 14195 bytes
Desc: image001.png
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170717/c3d5e4ff/attachment-0001.png>