Default Message in XML

Discussion created by RSA Admin

on Sep 16, 2008
Latest reply on Sep 16, 2008 by RSA Admin

Like • Show 0 Likes0
Comment • 8

As I understand the flow of a log message in a device XML, the message must first match a header then the messageid must match id1. Upon the first match to a MESSAGE, the log message is parsed and the flow through the parser is finished and exits, and there is no addition attempts to match the log message, correct?

I'm now thinking of the remaining log messages that would become unknown. Could a default message then be placed at the bottom of the XML that would attempt to match the messages that we have no interest in and do not want to be classified as unknown? So these would not show up in runs of send_unknownmessages.cmd?

Outcomes

8 Replies

RSA Admin Sep 16, 2008 10:23 AM
First point - the messageid variable in the HEADER tag must match id2 in the MESSAGE tag.

Second, yes, it is possible to put a "catch all" message in a device XML that will basically read in everything not defined by a more explicit message.
Like • Show 0 Likes0
Actions
- RSA Admin @ RSA Admin on Sep 16, 2008 11:08 AM
  Yes, id2.
  
  Can a wildcard be used for id2? For example, there is one header and two messages. Then the first Message has an id2="001"and the default Message has id2="*"
  Like • Show 0 Likes0
  Actions
  - RSA Admin @ RSA Admin on Sep 16, 2008 11:10 AM
    No, you cannot use any kind of wildcard for the messageid/id2. It must be an explicitly defined string.
    Like • Show 0 Likes0
    Actions
    - RSA Admin @ RSA Admin on Sep 16, 2008 11:30 AM
      REGEX?
      
      Would this go to the default Message if the messageid was not 001 or 002?
      
      <HEADER
      id1="0001"
      id2="0001"
      content="%GENERIC_FILEREADER-4: <mysessionid> <mydate> <mytime> <messageid> <!payload>" />
      
      <REGX
      name="myMessageID"
      parms="messageid"
      default=""
      expr="messageid(!{001|002}) ? 'myMessageID'" />
      
      <MESSAGE
          level="7"
          parse="1"
          parsedefvalue="1"
          tableid="27"
          id1="myMessageID"
          id2="myMEssageID"
          eventcategory="1901000000"
          content="<mydefaultmessage>" />
      Like • Show 0 Likes0
      Actions
      - RSA Admin @ RSA Admin on Sep 16, 2008 11:35 AM
        No - Conditional Variables (REGEX, Value Maps, and most Functions) only affect the contents of a variable in the content parameter of a MESSAGE tag.
        
        You cannot manipulate an id2 parameter - it has to be an explicitly defined string.
        Like • Show 0 Likes0
        Actions
        RSA Admin @ RSA Admin on Sep 16, 2008 11:51 AM
        How then could I create a default message?
        
        We have a device sending logs, of the possible hundreds of messages there are only two we are interested in parsing. Will the unknown messages result in an unknown device type?
        Like • Show 0 Likes0
        Actions
        RSA Admin @ RSA Admin on Sep 16, 2008 12:05 PM
        You will probably need to build a special header that reads what is normally a bit of fixed text into the MessageID varaible to pull it off, and use that string as the id2 parameter. This of course assumes that this will fit all messages.
        
        As long as the device was initally discovered correctly and all of the messages from that source can all be identified by at least one of the headers you set up, then no unknown devices would be discovered (caveat: this does not hold true if you have multi-device selected for that particular event source). Any unrecognized messages would simply categorized as undefined events for the known device type (remember - we still know where the event came from based on the IP Address)
        Like • Show 0 Likes0
        Actions
        RSA Admin @ RSA Admin on Sep 16, 2008 12:23 PM
        That is what I've seen and want to remedy. I have a multi-device as rhlinux, then a second device as my UDS, but I then get a 3rd device at the same IP as the other two, of device type unknown. My UDS is looking for two messages
        
        [[page no longer exists]] gbs01-etc.uhc.com Great Bay Beacon ENVLAB01 / ENVLAB01-ES Active
        [[page no longer exists]] gbs01-etc.uhc.com Unknown ENVLAB01 / ENVLAB01-ES Candidate
        [[page no longer exists]] gbs01-etc.uhc.com Linux ENVLAB01 / ENVLAB01-ES Active
        
        Like • Show 0 Likes0
        Actions

Default Message in XML

Outcomes

Related Content

Recommended Content