Open getkub opened 2 years ago
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
Below are list of common event.code
of Cisco IOS and most of them needs to be developed
EXCESSIVE_PARITY_ERROR
STATECHANGE
RFI
ADJCHANGE
NBR_RESET
NOTIFICATION
AUTHFAIL
AUTHENFAIL
UPDOWN
FRR_STATE
MSGDUMP
MAXPFXEXCEED
ECC_MSG
BADAUTH
STATE
IKMP_MODE_FAILURE
LTL_PARITY_CHECK
PLATFORM
FMANACLLOGMISSMSG
IPACCESSLOGNP
NF_PARITY_ERROR
BER_SF_ALARM
MAXPFX
SIGNAL
THRESHOLD_VIOLATION
CPU_WARNING_OVERTEMP
FAN_LOW_RPM
FAN_TRAY_MISSING
MULTI_FAN_LOW_RPM
INFO_USER_LOGOUT
INFO_GENERAL
INFO_SUCCESS
NOPACKET
BFD_SESS_UP
IKMP_BAD_MESSAGE
WARNING_LOGIN
CONFIG_I
IN_OUTLET_OVERTEMP
DAMPENING
TIMEOUT
BFD_SESS_DOWN
CLOSED
BFD_SESS_DESTROYED
IPACCESSLOGS
SESSION_STATE_DOWN
SESSION_STATE_UP
BFD_SESS_CREATED
ADJCHANGE_DETAIL
IPACCESSLOGDP
Docs available here.
@getkub Are you able to provide examples for testing?
attached samples samplelog.cisco.ios.log
Also attached some enrichments, which may be useful to externalise the logic cisco_ios_aci_fault_codes.csv cisco_ios_actions.csv cisco_ios_icmp_code.csv
In my view, the ingest pipeline should have a lookup/enrichment facility, that way the enrichments can be done outside the grok/parsing.
Documentation and test input:
Documentation but no test:
[ ] BADAUTH Error Message %GLBP-4-BADAUTH: Bad authentication received from %s, group %d Explanation Two routers participating in a Gateway Load Balancing Protocol group disagree on the valid authentication string. Recommended Action Use the glbp authentication interface command to repair the GLBP authentication discrepancy between the local system and the one whose IP address is reported.
Error Message %HSRP-4-BADAUTH: Bad authentication from %s, group %d, remote state %s Explanation Two routers participating in HSRP disagree on the valid authentication string. Recommended Action Use the standby authentication command to repair the HSRP authentication discrepancy between the local system and the one whose IP address is reported.
Error Message %HSRP-4-BADAUTH: Bad authentication from [IP_address], group [dec], remote state [chars] Explanation Two routers participating in HSRP disagree on the valid authentication string. Recommended Action Use the standby authentication command to repair the HSRP authentication discrepancy between the local system and the one whose IP address is reported.
Error Message %VRRP-4-BADAUTH: Bad authentication from %i, group %d, type %d Explanation Two routers participating in Virtual Router Redundancy Protocol (VRRP) disagree on authentication. Recommended Action Enter the vrrp authentication command to repair the VRRP authentication discrepancy between the local system and the system whose IP address is reported.
[ ] NOPACKET Error Message %DHCPV6C-3-NOPACKET: Cannot setup or duplicate a socket packet Explanation An error occurred that is probably related to a resource problem within the system. Recommended Action Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration.
Error Message %DHCPV6S-3-NOPACKET: Cannot setup or duplicate a DHCPv6 server socket packet Explanation An error occurred that is probably due to a resource problem within the system. Recommended Action No action is required.
[ ] TIMEOUT Error Message %C7600_SIP200_MP-4-TIMEOUT: Master CPU request timed out [chars] Explanation The line card CPU contains two CPU cores, one of which is the master CPU. The nonmaster CPU is not responding in time to the request from the master CPU. This warning indicates a transient software problem. The line card should continue to operate normally. Recommended Action If this message recurs, copy the message exactly as it appears on the console or in the system log. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. With some messages, these tools and utilities will supply clarifying information. Search for resolved software issues using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. If you still require assistance, open a case with the Technical Assistance Center via the Internet at http://tools.cisco.com/ServiceRequestTool/create, or contact your Cisco technical support representative and provide the representative with the information you have gathered. Attach the following information to your case in nonzipped, plain-text (.txt) format: the output of the show logging and show tech-support commands and your pertinent troubleshooting logs.
Error Message %MCT1E1-3-TIMEOUT: %s: %s failed: %d, state: %d, ml_id: %d progress: %d Explanation Linkrec is stuck at non-ready. This condition indicates a software error. Recommended Action Copy the message exactly as it appears on the console or in the system log. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. With some messages, these tools and utilities will supply clarifying information. Search for resolved software issues using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. If you still require assistance, open a case with the Technical Assistance Center via the Internet at http://tools.cisco.com/ServiceRequestTool/create, or contact your Cisco technical support representative and provide the representative with the information you have gathered. Attach the following information to your case in nonzipped, plain-text (.txt) format: the output of the show logging and show tech-support commands and your pertinent troubleshooting logs.
Error Message %SGBP-3-TIMEOUT: Peer [IP_address] bidding; state ’PB [chars]’ deleted Explanation This message is generated only when SGBP event debugging is enabled. It indicates that a peer timed out while closing a query. The connection has been dropped. Recommended Action Check the peer equipment and network media for problems.
Error Message %SIP200_MP-4-TIMEOUT: Master CPU request timed out [chars] Explanation The line card CPU contains two CPU cores, one of which is the master CPU. The nonmaster CPU is not responding in time to a request from the master CPU. This warning indicates a transient software problem. The line card should continue to operate normally. Recommended Action If this message recurs, copy the message exactly as it appears on the console or in the system log. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. With some messages, these tools and utilities will supply clarifying information. Search for resolved software issues using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. If you still require assistance, open a case with the Technical Assistance Center via the Internet at http://tools.cisco.com/ServiceRequestTool/create, or contact your Cisco technical support representative and provide the representative with the information you have gathered. Attach the following information to your case in nonzipped, plain-text (.txt) format: the output of the show logging and show tech-support commands and your pertinent troubleshooting logs.
Error Message %SPA_CHOCX_CWRP-3-TIMEOUT: Interface ([chars]): [chars] Explanation The line card did not reply to a query for SONET information from the CHOCX RP driver. This is an internal software error. Recommended Action Decode the traceback. Enter the debug hw-module subslot slot/bay oir plugin command while the problem is happening. Research and attempt to resolve the issue using the tools and utilities provided at http://www.cisco.com/tac. With some messages, these tools and utilities will supply clarifying information. Search for resolved software issues using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. If you still require assistance, open a case with the Technical Assistance Center via the Internet at http://tools.cisco.com/ServiceRequestTool/create, or contact your Cisco technical support representative and provide the representative with the information you have gathered. Attach the following information to your case in nonzipped, plain-text (.txt) format: the output of the show logging and show tech-support commands and your pertinent troubleshooting logs.
Error Message %VPDN-6-TIMEOUT: [chars] [chars] [chars] disconnected [chars] [chars] [chars][chars][chars] Explanation The platform (for example, the Cisco NAS/LAC or the HGW/LNS) has disconnected the user because of the expiration of a timer. This condition may be PPP negotiation-related or might be an absolute timeout for the session. Recommended Action If the session has timed out automatically, no action is required.
No documentation at in https://www.cisco.com/c/en/us/td/docs/ios/15_0sy/system/messages/15sysmg.pdf.
Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale
to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1
. Thank you for your contribution!
In terms of ADJCHANGE:
Apr 27 20:54:43.799 BST: %BGP-5-ADJCHANGE: neighbor 10.7.247.102 Down BFD adjacency down Apr 27 20:54:51.594 BST: %BGP-5-ADJCHANGE: neighbor 10.7.247.102 Up
Would be very useful to add these as an enhancement to the Cisco IOS integration. I'm currently using the following Grok to extract and it has worked well for us:
condition ctx.event.code == "ADJCHANGE"
(neighbor|peer) %{IP:neighbor.ip} (%{DATA:bgp.state.to} BFD|\(AS \d+\) old state (Established|OpenConfirm) event \w+ new state %{GREEDYDATA:bgp.state.to}|(?<bgp.state.to>Up)|(?<bgp.state.to>Down) .*|active (?<bgp.state.to>Down) .*)
It's certainly not a nice way of doing it, but it was my first time playing around with Grok, and if it ain't broke... ;)
Another one I don't see here is CLIENT_ADDED_TO_RUN_STATE for WLCs, which would also be a nice-to-have.
Apr 30 2024 13:01:55.365 UTC: %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: Chassis 1 R0/3: wncd: Username entry (exampleuser) joined with ssid (examplessid) for device with MAC: 0000.0000.0000
condition ctx.event.code == "CLIENT_ADDED_TO_RUN_STATE"
Chassis \d R\d/\d: wncd: Username entry \(%{GREEDYDATA:wlan_username}\) joined with ssid \(%{DATA:wlan_ssid}\) for device with MAC: %{GREEDYDATA:wlan_user_mac}
Hi Cisco IOS module needs further parsing and samples https://github.com/elastic/integrations/blob/main/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml
In above, the LOGIN_FAILED is not captured Please find the code and sample event for it
Sample event