I tried to parser the next messages:
[software internal system syslog] CLI command [user admin, mode [local]VALGP]: directory /hd-raid/
[software internal system syslog] CLI command [user admin, mode [local]VALGP(config)]: config
I assign variable "hostname" to :VALGP and variable "action" to (config). ESI dont found any error, but when I check the messageid, hostname its parsed like "VALGP(config)"
Why this happened?
HOw can I delimited the variable "hostname in the first message?
Im using ESI 1.2.1
In the first message I assign variable "hostname" to :VALGP and ESI parsed OK, but when I check the second message, hostname its parsed like "VALGP(config)".
De: Sean Koniarz
Enviado el: miércoles, 06 de abril de 2016 10:05 a.m.
Para: Adiel Navarro
Asunto: Re: - Delimited variables in ESI
<https://community.rsa.com/?et=watches.email.thread> RSA Link
Delimited variables in ESI
reply from Sean Koniarz <https://community.rsa.com/people/q34uIDVMhd4OHUIP5ACqx9qzxaksNWWiSAtP3Ws58yc%3D?et=watches.email.thread> in Security Analytics - View the full discussion <https://community.rsa.com/message/869601?et=watches.email.thread#comment-869601>
You will need to modify the parser manually. You can use or statements in parsers tho, so that will help. Going to try and write it out for what you will likely need to do with not knowing what your xml looks like.
Log
[software internal system syslog] CLI command [user admin, mode [local]VALGP]: directory /hd-raid/
Parser
[<fld1>] <event_description> [user <event_user>, mode [local]<hostname>]: <results>
Log
[software internal system syslog] CLI command [user admin, mode [local]VALGP(config)]: config
Parser
[<fld1>] <event_description> [user <event_user>, mode [local]<hostname>(<action>)]: <results>
As you can see with the top one it will add anything in the ]] section to hostname, but the second will do anything until the ( then it will do action for the rest. It is very static on how the parsers work for that version. But we can combine them like this
[<fld1>] <event_description> [user <event_user>, mode {[local]<hostname>]: | [local]<hostname>(<action>)]:} <results>
A | will act as an or statement for the parser so it is going to look at either the first style or the second style and parser correctly. If you want to post your xml or let me know how it works. I of course do not know the actual meta you want to populate but that was just for an example.
Let me try this, Sean
<MESSAGE
level="7"
parse="1"
parsedefvalue="1"
tableid="55"
id1="cli_30000_debug"
id2="cli_30000_debug"
eventcategory="1401040000"
content="[<service> <<cli:<number1>> cliparse.c:<number2>] CLI command [user <username>, mode {[local]<hostname>]: | <hostname>(<action>)]:} <msg>"/>
When I try to check this in ESI, this send the next message:
GLOBO_FIRMA
L.I. Adiel Jesús Navarro Rosado
Analista OyM Seguridad Operativa
*: <mailto:adiel.navarro@mail.telcel.com> adiel.navarro@mail.telcel.com
De: Sean Koniarz
Enviado el: miércoles, 06 de abril de 2016 02:26 p.m.
Para: Adiel Navarro
Asunto: Re: - Delimited variables in ESI
<https://community.rsa.com/?et=watches.email.thread> RSA Link
Delimited variables in ESI
reply from Sean Koniarz <https://community.rsa.com/people/q34uIDVMhd4OHUIP5ACqx9qzxaksNWWiSAtP3Ws58yc%3D?et=watches.email.thread> in Security Analytics - View the full discussion <https://community.rsa.com/message/869605?et=watches.email.thread#comment-869605>
What happend here?
CLI session started for Security Administrator staradmin on device /dev/pts/1 from ::ffff:10.188.62.7
I try to defined value “Security Administrator” like “group” and “staradmin” like “username”
When I check, only “Security” its parsed like group and “Administrator staradmin” its parsed like username
But in this message
CLI session started for Operator temporal on device /dev/pts/1 from ::ffff:10.188.6.7
“Operator” its defined like group and “temporal” like “username” ESI parsed this OK.
De: Sean Koniarz
Enviado el: miércoles, 06 de abril de 2016 02:26 p.m.
Para: Adiel Navarro
Asunto: Re: - Delimited variables in ESI
<https://community.rsa.com/?et=watches.email.thread> RSA Link
Delimited variables in ESI
reply from Sean Koniarz <https://community.rsa.com/people/q34uIDVMhd4OHUIP5ACqx9qzxaksNWWiSAtP3Ws58yc%3D?et=watches.email.thread> in Security Analytics - View the full discussion <https://community.rsa.com/message/869605?et=watches.email.thread#comment-869605>
Yeah so ESI in that state will actually consider the parsing a fail. You will need to deploy it into SA for it to work
Also, the parsing you wrote has three issues, first, do not use the 'msg' meta to parse, the msg is used to display the entire log message, so you will be doubling data some times, unless it works for you but we do not do that.
Second, there is too many spaces between the last } and the <msg>.
Third you forgot to add the last local.
Below should work, I would suggest adding the parser to the SA system and see if the logs come through. You can also inject the logs via CLI. NwLogPlayer -f /path/to/log/file
And lastely, if you have access to the SCOL I would suggest downloading the new 10.6 ESI which will be able to do better parsing for SA.
content="[<service> <<cli:<number1>> cliparse.c:<number2>] CLI command [user <username>, mode {[local]<hostname>]: | [local]<hostname>(<action>)]:} <msg>"/>
Sean.,
I only find ESI 1.2.1 on SCOL.
What is 10.6 ESI?
De: Sean Koniarz
Enviado el: jueves, 07 de abril de 2016 09:59 a.m.
Para: Adiel Navarro
Asunto: Re: - Delimited variables in ESI
<https://community.rsa.com/?et=watches.email.thread> RSA Link
Delimited variables in ESI
reply from Sean Koniarz <https://community.rsa.com/people/q34uIDVMhd4OHUIP5ACqx9qzxaksNWWiSAtP3Ws58yc%3D?et=watches.email.thread> in Security Analytics - View the full discussion <https://community.rsa.com/message/869659?et=watches.email.thread#comment-869659>
With the release of 10.6 they added a new ESI tool designed for SA. If you look in the SA Downloads you should see the new release.
Are you using the 10.6 ESI?