Help syslog subagent ClearPass
I'm trying to build a syslog subagent to parse Aruba Networks ClearPass logs. So far i have got ;
<(\d+)>(\d+\-\d+\-\d+ \d\d:\d\d:\d\d),(\d+) (\d+\.\d+\.\d+\.\d+) (\w+ \w+) (\d+) (\d+) (\d+) Timestamp=(\w+ \d+, \d+ \d\d:\d\d:\d\d \w+),(\w+)=([\w\s]+),(\w+)=([\w\s]+),(\w+)=([\w\s]+),(\w+)=(\w+),(\w+)=(\w+)[\W\s]+(\w+)(\\n([\w\s]+):[\W]+(\d+.\d+.\d+.\d+)\\n|\\n(\w+):[\W\s]+([\w\s]+)\\n(\w+[\W\s]+\w+):[\W\s]+([\w\d]+)\\n([\w\s]+):[\W]+(\d+.\d+.\d+.\d+)\\n)
But some times the log are not the same length and doesn't contains the exact same number of token or entry. I have added a sample log file.
It's my first regex flexcon/subagent, any help would be appreciated.
It's not the parsing that is not working. The Connector is not using the new parser.
I have create a file clearpass_subagent.sdkrfilereader.properties and i place it in /opt/arcsight/connector_1/current/user/agent/flexagent/syslog
But the connector is still only using the generic_syslog subagent. I tried modifying the syslog.properties file and it doesn't work. I get this error:
Unable to find class definition for [clearpass_syslog]
How can i make my connector use my subagent?