Back to listing

Cisco ASA Extractor

Other Solutions

Graylog extractor for use with Cisco ASA

marksie1988
free!

Published

14 Jan 06:42

Last Push

28 Oct 15:23

Marketplace Rating

No rating yet

Discussion

3 Comments

Your Rating

Please sign in to rate this add-on.

Comments

bitginsu almost 3 years ago

I tried to import this into the Graylog trial appliance which I set up last week, it show the (super helpful) error message: "Error There was an error adding the bundle, please try again later"
Is this content pack compatible with the Graylog 2.1.2 appliance?
Is there something I can edit to make it work?
Thanks!

chrisstone almost 3 years ago

I was having trouble picking up the Source and Timestamp on both ASA and IOS devices, so I made a few changes. If anyone is interested, here are my changes:

Source:
>(?:\\d+:|.*:\\d{2})\\s(\\S+)\\s?:(?:.*:)? %
Timestamp:
(\\w{3}\\s\\d{2}(?:\\s\\d{4})?\\s\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:\\s\\w{3})?)\\W.*%

Also, the configuration for IOS devices:
logging trap informational
logging origin-id hostname
logging host transport udp port
service timestamps log datetime year show-timezone

bpwaite almost 4 years ago

I am having an issue since implementing this:
Collection containing a total of 202 indexer failures
MapperParsingException[failed to parse [level]]; nested: NumberFormatException[For input string: "164>CA-ASA5510 %ASA-4-722051

Please sign in to comment.

Back to listing