Help syslog subagent ClearPass

[francois.devare]

Hi,

I'm trying to build a syslog subagent to parse Aruba Networks ClearPass logs. So far i have got ;

<(\d+)>(\d+\-\d+\-\d+ \d\d:\d\d:\d\d),(\d+)  (\d+\.\d+\.\d+\.\d+) (\w+ \w+) (\d+) (\d+) (\d+) Timestamp=(\w+ \d+, \d+ \d\d:\d\d:\d\d \w+),(\w+)=([\w\s]+),(\w+)=([\w\s]+),(\w+)=([\w\s]+),(\w+)=(\w+),(\w+)=(\w+)[\W\s]+(\w+)(\\n([\w\s]+):[\W]+(\d+.\d+.\d+.\d+)\\n|\\n(\w+):[\W\s]+([\w\s]+)\\n(\w+[\W\s]+\w+):[\W\s]+([\w\d]+)\\n([\w\s]+):[\W]+(\d+.\d+.\d+.\d+)\\n)

But some times the log are not the same length and doesn't contains the exact same number of token or entry. I have added a sample log file.

It's my first regex flexcon/subagent, any help would be appreciated.

Thanks,

[balahasan.v1]

Hi Francois,

PFA property file which is tested.. So u can continue updating this properties further on severity mapping and etc.....

I Hope this helps u buddy

[francois.devare]

Hi,

I uploaded the parser override to my ConnApp. After i uploaded it to the Connector and it doesn't work.

How to i have to install this file?

[vipiao]

Try:

<(\d+)>(\d+-\d+-\d+\s+\d+:\d+:\d+),(\d+)\s+(\d+\.\d+\.\d+\.\d+)\s+([\w\s]+)\s+(\d+)\s+(\d+)\s+(\d+)\s+Timestamp=(.*),Source=([^,]+),(?:Level=([^,]+),)?Category=([^,]+),Action=([^,]+),(?:Description=([^,]+)[\r\n]+)?(?:User=([^,]+)[\r\n]+)?

[francois.devare]

hi,

It's not the parsing that is not working. The Connector is not using the new parser.

I have create a file clearpass_subagent.sdkrfilereader.properties and i place it in /opt/arcsight/connector_1/current/user/agent/flexagent/syslog

But the connector is still only using the generic_syslog subagent. I tried modifying the syslog.properties file and it doesn't work. I get this error:

Unable to find class definition for [clearpass_syslog]

How can i make my connector use my subagent?

[balahasan.v1]

Hi

Since u have set everything, Have u modified in agent.properties and checked the parser in agent regex tool

Follow the steps defined in the document below and let us know, Since the Parser order is taking the Default Syslog Parser for parsing ur Logs

[francois.devare]

Hi,

With the help of the people here i was able to create my subagent to parse ClearPass syslogs. I have attached what i created so other people can use it.

[shezaf1]

To close the loop on that Aruba ClearPass now supports CEF. See .