Wednesday, February 16, 2022

[SOLVED] Syslog parse misformated logs

Issue

I have this kind of logs

May 13 17:39:34 192.168.x.254  2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.249:2050 (gi1/0/2 68:05:ca:10:14:87) -> 192.168.x.255:2050 dscp 0, 1 packets
May 13 17:39:34 192.168.x.254  2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.244:5678 (gi1/0/2 d4:ca:6d:da:2e:bb) -> 255.255.255.255:5678 dscp 0, 5 packets

It fetched from router via syslog to my debian server

In rsyslog config on server i added lines:

template (name="bsdlogformat" type="string" string="%hostname%  %timereported%  %syslogtag%%msg%\n")
template (name="fileformat" type="string" string="/var/log/rsyslogs/%HOSTNAME%-%syslogtag%.log")

:hostname, isequal, "192.168.x.254" ?fileformat;bsdlogformat

All works fine, except that filename creader like that:

192.168.x.254-.log

and result is:

192.168.x.254  May 13 17:39:34   2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.249:2050 (gi1/0/2 68:05:ca:10:14:87) -> 192.168.x.255:2050 dscp 0, 1 packets
192.168.x.254  May 13 17:39:34   2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.244:5678 (gi1/0/2 d4:ca:6d:da:2e:bb) -> 255.255.255.255:5678 dscp 0, 5 packets

So it did not detect %syslogtag%

Main problem here string

2020-05-13T17:50:47+00:00

I can't find way to force syslod thisks that its a date.

ow i can fix it?


Solution

I found solution, it actually simple:

template(name="bsdlogformat" type="list") {
    property(name="fromhost-ip")
    constant(value=" ")
    property(name="msg")
    constant(value="\n")
}

template (name="fileformat" type="string" string="/var/log/rsyslogs/%HOSTNAME%-main.log")
template (name="firewallfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-firewall.log")
template (name="authfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-auth.log")
template (name="sshfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-ssh.log")

if ($fromhost-ip == "192.168.0.254") then {
    if ($msg contains "FIREWALL-I-LOG")  then {
        action(type="omfile" dynaFile="firewallfile" Template="bsdlogformat")
    } else  if ($msg contains "AAA-LOCAL-N-AUTH")  then {
        action(type="omfile" dynaFile="authfile" Template="bsdlogformat")
    } else  if ($msg contains "AAA-LOCAL-W-AUTH")  then {
        action(type="omfile" dynaFile="authfile" Template="bsdlogformat")
    } else  if ($msg contains "AAA-E-SSH")  then {
        action(type="omfile" dynaFile="sshfile" Template="bsdlogformat")
    } else  if ($msg contains "AAA-I-SSH")  then {
        action(type="omfile" dynaFile="sshfile" Template="bsdlogformat")
    } else {
        action(type="omfile" dynaFile="fileformat" Template="bsdlogformat")
    } 
    stop

}

It just checks $msg and based on contain string put logs in files with prefixes.



Answered By - Vasilij Altunin
Answer Checked By - Katrina (WPSolving Volunteer)
at