<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Yes, below list of packages installed on my server from adiscon repository:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>liblognorm-0.3.6-1.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>liblognorm-devel-0.3.6-1.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>liblognorm-utils-0.3.6-1.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>liblognorm-debuginfo-0.3.6-1.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-mmjsonparse-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-debuginfo-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-mysql-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-elasticsearch-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-udpspoof-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>rsyslog-mmnormalize-7.4.4-2.el6.x86_64<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> lognorm-bounces@lists.adiscon.com [mailto:lognorm-bounces@lists.adiscon.com] <b>On Behalf Of </b>Rainer Gerhards<br><b>Sent:</b> Monday, September 23, 2013 2:48 AM<br><b>To:</b> lognorm<br><b>Subject:</b> Re: [Lognorm] liblognorm rules<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>do you have the latest version of liblognorm installed? I think I remember there was such a problem I fixed a couple of weeks ago...<br><br>Rainer<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Sep 18, 2013 at 9:42 PM, Castillo, Jose Contractor <<a href="mailto:Jose.Castillo@ssa.gov" target="_blank">Jose.Castillo@ssa.gov</a>> wrote:<o:p></o:p></p><div><div><p>Thanks, but it didn't work adding a space to the end.<o:p></o:p></p><p> <o:p></o:p></p><p>It works if I use only the first rule:<o:p></o:p></p><div><p>"<i>rule=: %%SYS-5-CONFIG_I: Configured from console by console</i>"<o:p></o:p></p><p> <o:p></o:p></p></div><p>It doesn’t work if the next two rules are defined:<o:p></o:p></p><div><p>"<i>rule=: %%SYS-5-CONFIG_I: Configured from console by console</i>"<o:p></o:p></p></div><p>“<i>rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% on console</i>”<o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p>I think it’s trying to match the second rule because “<i>console</i>” matches %<i>cisco.user:word% </i>and then is trying to match next characters, but I don’t know why is not matching the first rule.<o:p></o:p></p><p> <o:p></o:p></p><p>Any additional advice?<o:p></o:p></p><p> <o:p></o:p></p><p>Thanks,<o:p></o:p></p><p>Jose<o:p></o:p></p><div><div><p> <o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p>-----Original Message-----<br>From: <a href="mailto:lognorm-bounces@lists.adiscon.com" target="_blank">lognorm-bounces@lists.adiscon.com</a> [mailto:<a href="mailto:lognorm-bounces@lists.adiscon.com" target="_blank">lognorm-bounces@lists.adiscon.com</a>] On Behalf Of cclark<br>Sent: Wednesday, September 18, 2013 3:06 PM<br>To: <a href="mailto:lognorm@lists.adiscon.com" target="_blank">lognorm@lists.adiscon.com</a><br>Subject: Re: [Lognorm] liblognorm rules<o:p></o:p></p><p> <o:p></o:p></p><p>I've seen this happen before with Cisco devices. Try this: In your rule, add a white space to the end.<o:p></o:p></p><p> <o:p></o:p></p><p>So instead of this:<o:p></o:p></p><p> <o:p></o:p></p><p>"rule=: %%SYS-5-CONFIG_I: Configured from console by console"<o:p></o:p></p><p> <o:p></o:p></p><p>Try this:<o:p></o:p></p><p> <o:p></o:p></p><p>"rule=: %%SYS-5-CONFIG_I: Configured from console by console "<o:p></o:p></p><p> <o:p></o:p></p><p>Note the space at the end.<o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p>On Wed, 18 Sep 2013 12:16:57 -0400, Castillo, Jose Contractor wrote:<o:p></o:p></p><p>> Hello,<o:p></o:p></p><p>> <o:p></o:p></p><p>> I'm testing rsyslog/liblognorm trying to parse syslog messages from <o:p></o:p></p><p>> cisco devices, but in some cases liblognorm is not matching syslog <o:p></o:p></p><p>> messages with corresponding rules.<o:p></o:p></p><p>> <o:p></o:p></p><p>> Please see next information and let me know if something is wrong.<o:p></o:p></p><p>> <o:p></o:p></p><p>> <o:p></o:p></p><p>> ======================================================================<o:p></o:p></p><p>> =============================<o:p></o:p></p><p>> <o:p></o:p></p><p>> # cat test.rulebase<o:p></o:p></p><p>> prefix=%date:date-rfc3164%<o:p></o:p></p><p>> rule=: %%SYS-5-CONFIG_I: Configured from console by console<o:p></o:p></p><p>> rule=: %%SYS-5-CONFIG_I: Configured from console by vty%-:number%<o:p></o:p></p><p>> (%cisco.ip:ipv4%)<o:p></o:p></p><p>> rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% <o:p></o:p></p><p>> on vty%-:number% (%cisco.ip:ipv4%)<o:p></o:p></p><p>> rule=: %%SYS-5-CONFIG_I: Configured from console by %cisco.user:word% <o:p></o:p></p><p>> on console<o:p></o:p></p><p>> <o:p></o:p></p><p>> # lognormalizer -r test.rulebase<o:p></o:p></p><p>> Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured from console by console<o:p></o:p></p><p>> [cee@115 originalmsg="Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured <o:p></o:p></p><p>> from console by console" unparsed-data=""] Sep 18 13:09:02: <o:p></o:p></p><p>> %SYS-5-CONFIG_I: Configured from console by vty0<o:p></o:p></p><p>> (192.168.1.1)<o:p></o:p></p><p>> [cee@115 cisco.ip="192.168.1.1" date="Sep 18 13:09:02:"] Sep 18 <o:p></o:p></p><p>> 13:15:29: %SYS-5-CONFIG_I: Configured from console by user1 on<o:p></o:p></p><p>> vty0 (192.168.1.2)<o:p></o:p></p><p>> [cee@115 cisco.ip="192.168.1.2" cisco.user="user1" date="Sep 18 <o:p></o:p></p><p>> 13:15:29:"] Sep 18 13:29:28: %SYS-5-CONFIG_I: Configured from console <o:p></o:p></p><p>> by user2 on console<o:p></o:p></p><p>> [cee@115 cisco.user="user2" date="Sep 18 13:29:28:"]<o:p></o:p></p><p>> <o:p></o:p></p><p>> ======================================================================<o:p></o:p></p><p>> ===================================<o:p></o:p></p><p>> <o:p></o:p></p><p>> <o:p></o:p></p><p>> The first message ("_Sep 18 13:06:18: %SYS-5-CONFIG_I: Configured from <o:p></o:p></p><p>> console by console__"_) is not being parsed correctly.<o:p></o:p></p><p>> <o:p></o:p></p><p>> Output from lognormalizer in verbose mode:<o:p></o:p></p><p>> <o:p></o:p></p><p>> I'm working on a CentOS 6.4 virtual machine, and next packages have <o:p></o:p></p><p>> been installed:<o:p></o:p></p><p>> <o:p></o:p></p><p>> rsyslog-mmjsonparse-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-debuginfo-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-mysql-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-elasticsearch-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-udpspoof-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> rsyslog-mmnormalize-7.4.4-2.el6.x86_64<o:p></o:p></p><p>> <o:p></o:p></p><p>> Jose Castillo<o:p></o:p></p><p>> MicroTech ESS Contract<o:p></o:p></p><p>> Phone (410) 597-0194<o:p></o:p></p><p>> OTSO/DNE/NMB/NMST<o:p></o:p></p><p>> <a href="mailto:Jose.Castillo@ssa.gov" target="_blank"><span style='color:windowtext;text-decoration:none'>Jose.Castillo@ssa.gov</span></a> [1]<o:p></o:p></p><p>> <o:p></o:p></p><p>> <o:p></o:p></p><p>> <o:p></o:p></p><p>> Links:<o:p></o:p></p><p>> ------<o:p></o:p></p><p>> [1] <a href="mailto:Jose.Castillo@ssa.gov" target="_blank"><span style='color:windowtext;text-decoration:none'>mailto:Jose.Castillo@ssa.gov</span></a><o:p></o:p></p><p> <o:p></o:p></p><p>--<o:p></o:p></p><p>--<o:p></o:p></p><p>- Champ Clark III<o:p></o:p></p><p> Quadrant Information Security [<a href="http://quadrantsec.com" target="_blank">http://quadrantsec.com</a>]<o:p></o:p></p><p> o: 904.296.9100 x101<o:p></o:p></p><p> o: 800.539.9357 x101<o:p></o:p></p><p>_______________________________________________<o:p></o:p></p><p>Lognorm mailing list<o:p></o:p></p><p><a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><span style='color:windowtext;text-decoration:none'>Lognorm@lists.adiscon.com</span></a><o:p></o:p></p><p><a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank"><span style='color:windowtext;text-decoration:none'>http://lists.adiscon.net/mailman/listinfo/lognorm</span></a><o:p></o:p></p></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>Lognorm mailing list<br><a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br><a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>