WLC Parser error

[irfan_ansari017]

Dears,

I have created parser for WLC, only to map events which contains "Rogue".

In arcsight regex tool my parser is executing fine.

While putting it in the real-time i am getting below error,

INFO   | jvm 1    | 2016/06/26 12:49:05 | FATAL EXCEPTION:

INFO   | jvm 1    | 2016/06/26 12:49:05 | com.arcsight.agent.parsers.operation.WrongArgumentsException: All timestamp formats are wrong, please check your input[ANB-HO-WLC-CA3: *webauthRedirect: Jun 26 12:49:03.828]!

Kindly let me know where i am going wrong.

Attaching parser and sample logs for reference.

Regards,

Irfan

[irfan_ansari017 · Accepted solution]

Dears,

The solution to above problem which worked for me is,

WLC logs by default picking up CISCO NX-OS parser.

I deleted this from agent.properties "customsubagentlis" as no NX-OS reporting through this connector. Then deleted syslog.properties file.

Set "usecustomsubagentlist=true" and restart smartconnector.

After this message from Cisco WLC start parse correctly.

Kind regards

Irfan

[mwhit720]

What version of Cisco WLC are you using ?

Which connector.. SNMP unifiied or syslog ??

[irfan_ansari017]

Dear,

WLC ver 8.0.

Syslog.

Regards,

Irfan

[checky04]

Irfan,  is the solution applicable to WLC 8.2? I have parsing issue even I upgraded our connector to the latest one.  It seems the column "Name" and "Device Process Name" are not parsing correctly.  Thanks! Richel

[irfan_ansari017]

Dear Richel,

I have made the parser for verion 8.0 and worked for me, i am not sure about 8.2.

Below was the raw log format.

<182>HO-WLC-CA3: *Dot1x_NW_MsgTask_4: Jun 30 10:59:50.527: %APF-6-USER_NAME_CREATED: [PA]apf_ms.c:7869 Username entry (123456) with length (253) created for mobile 70:81:eb:27:6f:9c

Parsed in ArcSight as,

End Time	Name	Message	Device Event Class ID	Device Custom String2	Device Custom String3	Device Custom String5	Device Severity	Device Address	Device Host Name	Device Product	Device Vendor
May 29 2016 00:00:01	Unparsed Event	[PA]sisf_shim_utils.c:482 Entry deleted A=fe80::42cb:a8ff:fe2f:83fd V=2054 I=wireless:0 P=0000 M=	SISF:ENTRY_DELETED	SISF	ENTRY_DELETED	SISF-6-ENTRY_DELETED	6	12.23.32.21		NX-OS	CISCO

Thanks,

Irfan