search

splunk / splunk-connect-for-syslog

Splunk Connect for Syslog
Apache License 2.0
152 stars 107 forks source link

Request AS400 Device #2238

Closed shihab123 closed 9 months ago

shihab123 commented 10 months ago

What is the sc4s version ? 4.3.1 Is there a pcap available? Yes What the vendor name? AS400 What's the product name? AS400 Feature Request description: Onboard AS400 Device Data Should it support TCP or UDP? UDP Do you want to have it for local usage or prepare a github PR? local usage AS400_syslog_data.txt

ikheifets-splunk commented 10 months ago

Hello, @shihab123 !

According to your CEF logs your device is "PowerTech Interact". In this log format (CEF) vendor name and product name are embedded in message body.

Are you sure that this logs for AS400? As I understood you mean IBM device. This logs must be identified as PowerTech:Interact

shihab123 commented 10 months ago

Hello,

Vendor is IBM (ISeries) Product is called Interact

Thanks,

From: Ilya @.> Sent: Friday, October 13, 2023 5:29 AM To: splunk/splunk-connect-for-syslog @.> Cc: shihab123 @.>; Mention @.> Subject: Re: [splunk/splunk-connect-for-syslog] Request AS400 Device (Issue #2238)

Hello, @shihab123https://github.com/shihab123 !

According to your CEF logs your device is "PowerTech Interact". In this log format (CEF) vendor name and product name are embedded in message header.

Are you sure that this logs for AS400? As I understood you mean IBM device.

— Reply to this email directly, view it on GitHubhttps://github.com/splunk/splunk-connect-for-syslog/issues/2238#issuecomment-1761208337, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ACAH4PHA5CI55YW4JBVCBDDX7ECYPAVCNFSM6AAAAAA56DMUE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONRRGIYDQMZTG4. You are receiving this because you were mentioned.Message ID: @.***>

ikheifets-splunk commented 10 months ago

@shihab123 if it's okay if we will identify in splunk such device as "PowerTech Interact" ( this vendor information was encoded in logs) ?

shihab123 commented 10 months ago

Hello,

That should be fine.

From: Ilya @.> Sent: Friday, October 13, 2023 10:38 AM To: splunk/splunk-connect-for-syslog @.> Cc: shihab123 @.>; Mention @.> Subject: Re: [splunk/splunk-connect-for-syslog] Request AS400 Device (Issue #2238)

@shihab123https://github.com/shihab123 if it's okay if we will identify in splunk such device as "PowerTech Interact", because this vendor information was encoded in logs?

— Reply to this email directly, view it on GitHubhttps://github.com/splunk/splunk-connect-for-syslog/issues/2238#issuecomment-1761630738, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ACAH4PHK7FKHY3UQNLARM7TX7FG43AVCNFSM6AAAAAA56DMUE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONRRGYZTANZTHA. You are receiving this because you were mentioned.Message ID: @.***>

ikheifets-splunk commented 10 months ago

@shihab123 Cool, thanks! Can you please also provide .pcap file with that logs? In your txt files hidden message headers like log date, hostname, etc. I need it because I wanna help you and also it can help me to doublecheck that parser working correctly.

ikheifets-splunk commented 10 months ago

@shihab123 Just give me a PCAP file and I will make PR on 1-2 days.

ikheifets-splunk commented 10 months ago

Hello @shihab123 ! You don't provided me pcap file :( I need to test my Pull Request.

By this reason please test it by yourself using development version of sc4s (docker image) . You just need to update your sc4s on that development version. And tell is it working for you or not. If yes we will merge it.

P.S. Please also tell me what index would be fluent for that logs. Currently it's going to netops

ikheifets-splunk commented 10 months ago

@shihab123 I created pull request for your issue, please test is it work for you, and if yes, I will merge it. You just need to update your sc4s on that development version of sc4s (docker image) to check your logs format.