<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>Thanks, but it didn't work adding a space to the end.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>It works if I use only the first rule:<o:p></o:p></p><p class=MsoPlainText>"<i>rule=: %%SYS-5-CONFIG_I: Configured from console by console</i>"<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>It doesn’t work if the next two rules are defined:<o:p></o:p></p><p class=MsoPlainText>"<i>rule=: %%SYS-5-CONFIG_I: Configured from console by console</i>"<o:p></o:p></p><p class=MsoPlainText>“<i>rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% on console</i>”<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I think it’s trying to match the second rule because “<i>console</i>” matches %<i>cisco.user:word% </i>and then is trying to match next characters, but I don’t know why is not matching the first rule.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Any additional advice?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Thanks,<o:p></o:p></p><p class=MsoPlainText>Jose<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----Original Message-----<br>From: lognorm-bounces@lists.adiscon.com [mailto:lognorm-bounces@lists.adiscon.com] On Behalf Of cclark<br>Sent: Wednesday, September 18, 2013 3:06 PM<br>To: lognorm@lists.adiscon.com<br>Subject: Re: [Lognorm] liblognorm rules</p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I've seen this happen before with Cisco devices. Try this: In your rule, add a white space to the end.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>So instead of this:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>"rule=: %%SYS-5-CONFIG_I: Configured from console by console"<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Try this:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>"rule=: %%SYS-5-CONFIG_I: Configured from console by console "<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Note the space at the end.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On Wed, 18 Sep 2013 12:16:57 -0400, Castillo, Jose Contractor wrote:<o:p></o:p></p><p class=MsoPlainText>> Hello,<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> I'm testing rsyslog/liblognorm trying to parse syslog messages from <o:p></o:p></p><p class=MsoPlainText>> cisco devices, but in some cases liblognorm is not matching syslog <o:p></o:p></p><p class=MsoPlainText>> messages with corresponding rules.<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Please see next information and let me know if something is wrong.<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> <o:p></o:p></p><p class=MsoPlainText>> ======================================================================<o:p></o:p></p><p class=MsoPlainText>> =============================<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> # cat test.rulebase<o:p></o:p></p><p class=MsoPlainText>> prefix=%date:date-rfc3164%<o:p></o:p></p><p class=MsoPlainText>> rule=: %%SYS-5-CONFIG_I: Configured from console by console<o:p></o:p></p><p class=MsoPlainText>> rule=: %%SYS-5-CONFIG_I: Configured from console by vty%-:number%<o:p></o:p></p><p class=MsoPlainText>> (%cisco.ip:ipv4%)<o:p></o:p></p><p class=MsoPlainText>> rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% <o:p></o:p></p><p class=MsoPlainText>> on vty%-:number% (%cisco.ip:ipv4%)<o:p></o:p></p><p class=MsoPlainText>> rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% <o:p></o:p></p><p class=MsoPlainText>> on console<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> # lognormalizer -r test.rulebase<o:p></o:p></p><p class=MsoPlainText>> Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured from console by console<o:p></o:p></p><p class=MsoPlainText>> [cee@115 originalmsg="Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured <o:p></o:p></p><p class=MsoPlainText>> from console by console" unparsed-data=""] Sep 18 13:09:02: <o:p></o:p></p><p class=MsoPlainText>> %SYS-5-CONFIG_I: Configured from console by vty0<o:p></o:p></p><p class=MsoPlainText>> (192.168.1.1)<o:p></o:p></p><p class=MsoPlainText>> [cee@115 cisco.ip="192.168.1.1" date="Sep 18 13:09:02:"] Sep 18 <o:p></o:p></p><p class=MsoPlainText>> 13:15:29: %SYS-5-CONFIG_I: Configured from console by user1 on<o:p></o:p></p><p class=MsoPlainText>> vty0 (192.168.1.2)<o:p></o:p></p><p class=MsoPlainText>> [cee@115 cisco.ip="192.168.1.2" cisco.user="user1" date="Sep 18 <o:p></o:p></p><p class=MsoPlainText>> 13:15:29:"] Sep 18 13:29:28: %SYS-5-CONFIG_I: Configured from console <o:p></o:p></p><p class=MsoPlainText>> by user2 on console<o:p></o:p></p><p class=MsoPlainText>> [cee@115 cisco.user="user2" date="Sep 18 13:29:28:"]<o:p></o:p></p><p class=MsoPlainText>> <o:p></o:p></p><p class=MsoPlainText>> ======================================================================<o:p></o:p></p><p class=MsoPlainText>> ===================================<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> The first message ("_Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured from <o:p></o:p></p><p class=MsoPlainText>> console by console__"_) is not being parsed correctly.<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Output from lognormalizer in verbose mode:<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> I'm working on a CentOS 6.4 virtual machine, and next packages have <o:p></o:p></p><p class=MsoPlainText>> been installed:<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> rsyslog-mmjsonparse-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-debuginfo-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-mysql-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-elasticsearch-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-udpspoof-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>> rsyslog-mmnormalize-7.4.4-2.el6.x86_64<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Jose Castillo<o:p></o:p></p><p class=MsoPlainText>> MicroTech ESS Contract<o:p></o:p></p><p class=MsoPlainText>> Phone (410) 597-0194<o:p></o:p></p><p class=MsoPlainText>> OTSO/DNE/NMB/NMST<o:p></o:p></p><p class=MsoPlainText>> <a href="mailto:Jose.Castillo@ssa.gov"><span style='color:windowtext;text-decoration:none'>Jose.Castillo@ssa.gov</span></a> [1]<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Links:<o:p></o:p></p><p class=MsoPlainText>> ------<o:p></o:p></p><p class=MsoPlainText>> [1] <a href="mailto:Jose.Castillo@ssa.gov"><span style='color:windowtext;text-decoration:none'>mailto:Jose.Castillo@ssa.gov</span></a><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>--<o:p></o:p></p><p class=MsoPlainText>--<o:p></o:p></p><p class=MsoPlainText>- Champ Clark III<o:p></o:p></p><p class=MsoPlainText> Quadrant Information Security [http://quadrantsec.com]<o:p></o:p></p><p class=MsoPlainText> o: 904.296.9100 x101<o:p></o:p></p><p class=MsoPlainText> o: 800.539.9357 x101<o:p></o:p></p><p class=MsoPlainText>_______________________________________________<o:p></o:p></p><p class=MsoPlainText>Lognorm mailing list<o:p></o:p></p><p class=MsoPlainText><a href="mailto:Lognorm@lists.adiscon.com"><span style='color:windowtext;text-decoration:none'>Lognorm@lists.adiscon.com</span></a><o:p></o:p></p><p class=MsoPlainText><a href="http://lists.adiscon.net/mailman/listinfo/lognorm"><span style='color:windowtext;text-decoration:none'>http://lists.adiscon.net/mailman/listinfo/lognorm</span></a><o:p></o:p></p></div></body></html>