/usr/share/logsparser/normalizers/cisco-asa_header.xml is in python-logsparser 0.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 | <?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- pylogsparser - Logs parsers python library -->
<!-- Copyright (C) 2011 Wallix Inc. -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- This package is free software; you can redistribute -->
<!-- it and/or modify it under the terms of the GNU Lesser -->
<!-- General Public License as published by the Free Software -->
<!-- Foundation; either version 2.1 of the License, or (at -->
<!-- your option) any later version. -->
<!-- -->
<!-- This package is distributed in the hope that it will be -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -->
<!-- PURPOSE. See the GNU Lesser General Public License for -->
<!-- more details. -->
<!-- -->
<!-- You should have received a copy of the GNU Lesser General -->
<!-- Public License along with this package; if not, write -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place, -->
<!-- Suite 330, Boston, MA 02111-1307 USA -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="cisco-asa_header"
version="0.99"
unicode="yes"
ignorecase="yes"
matchtype="match"
appliedTo="raw">
<description>
<localized_desc language="en">This normalizer is able to parse logs received via the syslog
export facility from a Cisco ASA. The normalizer has been validated with Cisco ASA version 8.4.
The standard export format (No EMBLEM format) with "Device ID" and "timestamp" options must be
selected for this normalizer.
</localized_desc>
<localized_desc language="fr">Ce normaliseur reconnaît les logs Cisco ASA exportés via
la facilité syslog. Ce normaliseur a été validé avec la version 8.4 de l'IOS Cisco ASA.
Le format d'export standard (Non EMBLEM) doit être sélectionné avec les options "Device ID" et
"timestamp".
</localized_desc>
</description>
<authors>
<author>fbo@wallix.com</author>
</authors>
<tagTypes>
<tagType name="syslogPriority" type="integer">
<description>
<localized_desc language="en">Expression matching a syslog line priority, defined as 8*facility + severity.</localized_desc>
<localized_desc language="fr">Expression correspondant à la priorité du message, suivant la formule 8 x facilité + gravité.</localized_desc>
</description>
<regexp>\d{1,3}</regexp>
</tagType>
<tagType name="dateASA1" type="datetime">
<description>
<localized_desc language="en">Expression matching a date in the DDD MMM dd hh:mm:ss YYYY format.</localized_desc>
<localized_desc language="fr">Expression correspondant à la date au format DDD MMM dd hh:mm:ss YYYY.</localized_desc>
</description>
<regexp>[A-Z]{1}[a-z]{2} [0-9]{1,2} [0-9]{4} \d{2}:\d{2}:\d{2}</regexp>
</tagType>
<tagType name="deviceID" type="basestring">
<description>
<localized_desc language="en">Expression matching the device ID.</localized_desc>
<localized_desc language="fr">Expression correspondant à l'identifiant de l'équipement.</localized_desc>
</description>
<regexp>[^: ]+</regexp>
</tagType>
</tagTypes>
<callbacks>
<callback name="decode_priority">
# define facilities
FACILITIES = { 0: "kernel",
1: "user",
2: "mail",
3: "daemon",
4: "auth",
5: "syslog",
6: "print",
7: "news",
8: "uucp",
9: "ntp",
10: "secure",
11: "ftp",
12: "ntp",
13: "audit",
14: "alert",
15: "ntp" }
for i in range(0, 8):
FACILITIES[i+16] = "local%d" % i
# define severities
SEVERITIES = { 0: "emerg",
1: "alert",
2: "crit",
3: "error",
4: "warn",
5: "notice",
6: "info",
7: "debug" }
facility = int(value) / 8
severity = int(value) % 8
if facility not in FACILITIES or severity not in SEVERITIES:
raise ValueError('facility or severity is out of range')
log["facility"] = "%s" % FACILITIES[facility]
log["severity"] = "%s" % SEVERITIES[severity]
log["facility_code"] = "%d" % facility
log["severity_code"] = "%d" % severity
</callback>
<callback name="decode_asa_severity">
SEVERITIES = { 0: "emerg",
1: "alert",
2: "crit",
3: "error",
4: "warn",
5: "notice",
6: "info",
7: "debug" }
log["severity_code"] = "%s" % str(value)
log["severity"] = "%s" % SEVERITIES[int(value)]
</callback>
</callbacks>
<patterns>
<pattern name="asa-001">
<description>
<localized_desc language="en">Expression matching the Cisco ASA Syslog header</localized_desc>
<localized_desc language="fr">Expression validant l'entête Syslog d'un équipement Cisco ASA</localized_desc>
</description>
<text><PRIORITY>DATE SOURCE : %ASA-SEVERITY-MNEMONIC: BODY</text>
<tags>
<tag name="__priority" tagType="syslogPriority">
<description>
<localized_desc language="en">the log's priority</localized_desc>
<localized_desc language="fr">la priorité du log, égale à 8 x facilité + gravité</localized_desc>
</description>
<substitute>PRIORITY</substitute>
<callbacks>
<callback>decode_priority</callback>
</callbacks>
</tag>
<tag name="date" tagType="dateASA1">
<description>
<localized_desc language="en">the log's date</localized_desc>
<localized_desc language="fr">l'horodatage du log</localized_desc></description>
<substitute>DATE</substitute>
<callbacks>
<callback>MMM dd YYYY hh:mm:ss</callback>
</callbacks>
</tag>
<tag name="source" tagType="deviceID">
<description>
<localized_desc language="en">the log's source (device ID)</localized_desc>
<localized_desc language="fr">l'équipement ASA à l'origine de l'événement</localized_desc></description>
<substitute>SOURCE</substitute>
</tag>
<tag name="__cseverity" tagType="Integer">
<description>
<localized_desc language="en">the log's severity</localized_desc>
<localized_desc language="fr">la severité du log</localized_desc>
</description>
<substitute>SEVERITY</substitute>
<callbacks>
<callback>decode_asa_severity</callback>
</callbacks>
</tag>
<tag name="event_id" tagType="Integer">
<description>
<localized_desc language="en">the Cisco ID of the event</localized_desc>
<localized_desc language="fr">l'identifiant Cisco de l'évenement</localized_desc>
</description>
<substitute>MNEMONIC</substitute>
</tag>
<tag name="body" tagType="Anything">
<description>
<localized_desc language="en">the actual event message</localized_desc>
<localized_desc language="fr">le message décrivant l'événement</localized_desc>
</description>
<substitute>BODY</substitute>
</tag>
</tags>
<commonTags>
<commonTag name="program">cisco-asa</commonTag>
</commonTags>
<examples>
<example>
<text><165>Jan 25 2012 18:31:09 ciscoasa : %ASA-5-111008: User 'enable_15' executed the 'logging host inside2 192.168.30.2 6/11508' command.</text>
<expectedTags>
<expectedTag name="facility">local4</expectedTag>
<expectedTag name="severity">notice</expectedTag>
<expectedTag name="severity_code">5</expectedTag>
<expectedTag name="source">ciscoasa</expectedTag>
<expectedTag name="date">2012-01-25 18:31:09</expectedTag>
<expectedTag name="event_id">111008</expectedTag>
<expectedTag name="program">cisco-asa</expectedTag>
<expectedTag name="body">User 'enable_15' executed the 'logging host inside2 192.168.30.2 6/11508' command.</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
</patterns>
</normalizer>
|