You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Casey Stella (JIRA)" <ji...@apache.org> on 2016/11/02 19:13:58 UTC
[jira] [Updated] (METRON-166) Create Big IP Parser
[ https://issues.apache.org/jira/browse/METRON-166?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Casey Stella updated METRON-166:
--------------------------------
Fix Version/s: (was: 0.2.2BETA)
> Create Big IP Parser
> --------------------
>
> Key: METRON-166
> URL: https://issues.apache.org/jira/browse/METRON-166
> Project: Metron
> Issue Type: New Feature
> Reporter: Morgan Emery
> Priority: Minor
> Labels: platform
> Original Estimate: 48h
> Remaining Estimate: 48h
>
> Create a parser for Big IP VPN logs. There are multiple log types, below are some samples with their expected parsed outputs.
> <141>Apr 19 19:24:29 mfugjchwna38k notice mdd4[6456]: 90329500:5: 37451372: New session from client IP 10.000.11.000 (ST=/CC=/C=) at VIP 240.61.45.23 Listener /Common/access.google.com_443 (Reputation=Unknown)
> {
> "priority": 141,
> "timestamp": 1461093869000,
> "hostname": "mfugjchwna38k",
> "severity": "notice",
> "process": "mdd4",
> "process_id": 6456,
> "ip_src_addr": "10.000.11.000",
> "ip_vip": "240.61.45.23",
> "big_ip_log_code": 90329500,
> "big_ip_message_type": "session",
> "vpn_session_id": 37451372,
> "source.type": "bigip",
> "original_string": "<141>Apr 19 19:24:29 mfugjchwna38k notice mdd4[6456]: 90329500:5: 37451372: New session from client IP 10.000.11.000 (ST=/CC=/C=) at VIP 123.45.678.90 Listener /Common/access.google.com_443 (Reputation=Unknown)"
> }
> <141>Mar 31 13:46:35 mfugjchwna38k notice apd[6848]: 90329113:5: 1d0bf7c7: session.logon.euid is ABC906
> {
> "priority": 141,
> "timestamp": "1459431995000",
> "hostname": "mfugjchwna38k",
> "severity": "notice",
> "process": "apd",
> "process_id": 6848,
> "big_ip_log_code": 90329113,
> "big_ip_message_type": "login",
> "vpn_session_id": "1d0bf7c7",
> "user_id": "ABC906",
> "source.type": "bigip",
> "original_string": "<141>Mar 31 13:46:35 mfugjchwna38k notice apd[6848]: 90329113:5: 1d0bf7c7: session.logon.euid is IKU906"
> }
> <141>Mar 31 13:59:37 mfugjchwna38k notice mdd[6456]: 90329521:5: 690fe490: Session statistics - bytes in: 3032, bytes out: 469
> {
> "priority": 141,
> "timestamp": 1459432777000,
> "hostname": "mfugjchwna38k",
> "severity": "notice",
> "process": "mdd",
> "process_id": 6456,
> "big_ip_log_code": 90329521,
> "vpn_session_id": "690fe490",
> "big_ip_message_type": "statistics",
> "bytesIn": 3032,
> "bytesOut": 469,
> "source.type": "bigip",
> "original_string": "<141>Mar 31 13:59:37 mfugjchwna38k notice mdd[6456]: 90329521:5: 690fe490: Session statistics - bytes in: 3032, bytes out: 469"
> }
> <141>Mar 31 13:59:32 vdcbigaion02p notice apd[26861]: 90329102:5: 01030c62: Access policy result: Network_Access
> {
> "priority": 141,
> "timestamp": 1459447172,
> "hostname": "vdcbigaion02p",
> "severity": "notice",
> "process": "apd",
> "process_id": 26861,
> "big_ip_log_code": 90329102,
> "vpn_session_id": "01030c62",
> "big_ip_message_type": "access policy result",
> "access_policy_result": "Network_Access",
> "source.type": "bigip",
> "original_string": "<141>Mar 31 13:59:32 vdcbigaion02p notice apd[26861]: 90329102:5: 01030c62: Access policy result: Network_Access"
> }
> <141>Mar 31 13:59:31 mfugjchwna38k notice apd[6848]: 90329115:5: 090faa3e: Following rule 'fallback' from item 'clog1220' to terminalout 'Out'
> {
> "priority": 141,
> "timestamp": 1459447171000,
> "hostname": "mfugjchwna38k",
> "severity": "notice",
> "process": "apd",
> "process_id": 6848,
> "big_ip_log_code": 90329115,
> "big_ip_message_type": "session",
> "vpn_session_id": "090faa3e",
> "message": "Following rule 'fallback' from item 'clog1220' to terminalout 'Out'",
> "source.type": "bigip",
> "original_string": "<141>Mar 31 13:59:31 mfugjchwna38k notice apd[6848]: 90329115:5: 090faa3e: Following rule 'fallback' from item 'clog1220' to terminalout 'Out'"
> }
> <182>Mar 31 13:59:34 vdcbigaion01p info logger: [ssl_acc] 10.24.248.20 - admin [31/Mar/2016:13:59:34 +0000] "/iControl/iControlPortal.cgi" 200 670
> {
> "priority": 182,
> "timestamp": 1459432774000,
> "hostname": "vdcbigaion01p",
> "severity": "info",
> "big_ip_message_type": "system",
> "message": "logger: [ssl_acc] 10.24.248.20 - admin [31/Mar/2016:13:59:34 +0000] "/iControl/iControlPortal.cgi" 200 670",
> "source.type": "bigip",
> "original_string": "<182>Mar 31 13:59:34 vdcbigaion01p info logger: [ssl_acc] 10.24.248.20 - admin [31/Mar/2016:13:59:34 +0000] \"/iControl/iControlPortal.cgi\" 200 670"
> }
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)