Parsing syslogs from different Cisco devices to Logstash

Rinat · February 10, 2017, 3:22pm

My scenario is as follows: rsyslog server collects logs from different Cisco gears. It then forwards it to Logstash as syslogs type.

Are there any configuration examples for Logstash to filter all the different Cisco devices? Any examples of filters/config files?

Running 5.1 on RHEL 6.

magnusbaeck · February 13, 2017, 10:39am

There are a bunch of Cisco patterns bundled with Logstash:

github.com

logstash-plugins/logstash-patterns-core/blob/v4.0.2/patterns/firewalls

# NetScreen firewall logs
NETSCREENSESSIONLOG %{SYSLOGTIMESTAMP:date} %{IPORHOST:device} %{IPORHOST}: NetScreen device_id=%{WORD:device_id}%{DATA}: start_time=%{QUOTEDSTRING:start_time} duration=%{INT:duration} policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:proto} src zone=%{WORD:src_zone} dst zone=%{WORD:dst_zone} action=%{WORD:action} sent=%{INT:sent} rcvd=%{INT:rcvd} src=%{IPORHOST:src_ip} dst=%{IPORHOST:dst_ip} src_port=%{INT:src_port} dst_port=%{INT:dst_port} src-xlated ip=%{IPORHOST:src_xlated_ip} port=%{INT:src_xlated_port} dst-xlated ip=%{IPORHOST:dst_xlated_ip} port=%{INT:dst_xlated_port} session_id=%{INT:session_id} reason=%{GREEDYDATA:reason}

#== Cisco ASA ==
CISCO_TAGGED_SYSLOG ^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}:
CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}
CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)
# Common Particles
CISCO_ACTION Built|Teardown|Deny|Denied|denied|requested|permitted|denied by ACL|discarded|est-allowed|Dropping|created|deleted
CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*
CISCO_DIRECTION Inbound|inbound|Outbound|outbound
CISCO_INTERVAL first hit|%{INT}-second interval
CISCO_XLATE_TYPE static|dynamic
# ASA-1-104001
CISCOFW104001 \((?:Primary|Secondary)\) Switching to ACTIVE - %{GREEDYDATA:switch_reason}
# ASA-1-104002
CISCOFW104002 \((?:Primary|Secondary)\) Switching to STANDBY - %{GREEDYDATA:switch_reason}
# ASA-1-104003
CISCOFW104003 \((?:Primary|Secondary)\) Switching to FAILED\.
# ASA-1-104004

This file has been truncated. show original

Rinat · February 13, 2017, 6:41pm

Thanks!

My understanding is that I need to include those lines inside grok filter? How would I go about it?

Best regards,

Rinat

Topic		Replies	Views
Cisco Log Processing Logstash	23	20264	May 1, 2017
Groking of cisco switch logs (non asa) Logstash	1	2308	March 12, 2018
Cisco asa - grok failure probably Logstash	9	3443	September 3, 2018
Cisco ASA Patterns in Logstash 1.5.1 Logstash	10	8839	July 6, 2017
Sending cisco wlc syslog to logstash Logstash	1	1390	September 14, 2017

Parsing syslogs from different Cisco devices to Logstash

Related topics