Content Pack for Cisco Switches and Routers (Graylog3 supported)

Content Pack

Graylog plugins and Content Packs for Cisco IOS/IOS-XE/NX

hrleinonen

free!

Download from Github View on Github 0 1

Published

08 May 13:05

Last Push

08 May 13:02

Marketplace Rating

No rating yet

Discussion

3 Comments

Readme from Github

Graylog3 supported

Content Pack includes:

Couple new GROK patern files
- CISCO_MNEMONIC_FIRSTPART
- CISCO_MNEMONIC_LASTPART
Extractors for syslog messages
- Supported new fields in search: CISCO_MESSAGE = Full syslog message CISCO_MNEMONIC_FIRSTPART = Mnemonic first part like SYS, LINK or PARSER CISCO_MNEMONIC_LASTPART = Mnemonic last part like MODEM_UP, CONFIG_I or UPDOWN CISCO_MNEMONIC = Full Mnemonic like SYS-5-CONFIG_I, LINEPROTO-5-UPDOWN or CISCO800-2-MODEM_UP
Basic dashboard called Cisco "Switches And Routers"
- 10 Most Used MNEMONICS 1 Day
- 10 Least Used MNEMONICS 1 Day
- Cisco Syslog Levels 1 Day
- Top 10 Syslog Senders 1 Day
- 10 Least Common MSG 1 Day
- 10 Most Common MSG 1 Day
- Number of Messages per hour **** NOTE START ****
- Edit search query source if needed, default is "gl2_source_input:5cc199348a66df5bf971ef41" **** NOTE END ****
Default input port is 1515

Cisco syslog config example: #logging origin-id ip #logging source-interface #logging host transport udp port 1515

Happy logging,

/Ville

Your Rating

Please sign in to rate this add-on.

Comments

hrleinonen 3 months ago

Hi,

I will check plugin against new graylog version in two weeks and get back again.

Br,

Ville

javigutii 4 months ago

Hello,

please can u help me, when I click on Inputs > Manage Extractors > Actions > Import Extractors > Add extractors to input. Nothings happens, do u know what Im doing wrong? Thank you.

yoder731 6 months ago

Was the CISCO_MESSAGE extractor removed?

Please sign in to comment.

Back to listing