Cisco ASA Extractor
Other Solutions
Graylog extractor for use with Cisco ASA
Published
14 Jan 06:42
Last Push
28 Oct 15:23
Marketplace Rating
Discussion
3 Comments
Your Rating
Please sign in to rate this add-on.
Comments
I was having trouble picking up the Source and Timestamp on both ASA and IOS devices, so I made a few changes. If anyone is interested, here are my changes:
Source:
>(?:\\d+:|.*:\\d{2})\\s(\\S+)\\s?:(?:.*:)? %
Timestamp:
(\\w{3}\\s\\d{2}(?:\\s\\d{4})?\\s\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:\\s\\w{3})?)\\W.*%
Also, the configuration for IOS devices:
logging trap informational
logging origin-id hostname
logging host transport udp port
service timestamps log datetime year show-timezone
I am having an issue since implementing this:
Collection containing a total of 202 indexer failures
MapperParsingException[failed to parse [level]]; nested: NumberFormatException[For input string: "164>CA-ASA5510 %ASA-4-722051
Please sign in to comment.
I tried to import this into the Graylog trial appliance which I set up last week, it show the (super helpful) error message: "Error There was an error adding the bundle, please try again later"
Is this content pack compatible with the Graylog 2.1.2 appliance?
Is there something I can edit to make it work?
Thanks!