#Sourcetype pour Hirschmann rs30
[hirschmann:rs30]
SHOULD_LINEMERGE=false
KV_MODE = none
EXTRACT-hirschmann-rs30-generic = (?<device_time>\w+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}) (?<reported_hostname>\S+)(-[0-9]+)? (?<process>[^\[]+)\[(?<pid>\d+)\]: (?<code_file>\S+\.c)\((?<line>\d+)\) (?<event_id>\d+) %% (?<message_text>.+)
EXTRACT-hirschmann-rs30-h_types = c\(\d+\) \d+ %% (?<type>H_(?<severity>\S+))\s+(?<event>\S+)
EXTRACT-hirschmann-rs30-cmd_logger = cmd_logger_api.c\(\d+\) \d+ %% (?<type>CLI):(?<src_ip>[\d\.]+):(?<user>[^:]+):(?<command>.+)
EXTRACT-hirschmann-rs30-authent_failure = traputil.c\(\d+\) \d+ %% (?<type>Authent. Failure): Unit: (?<unit>\d+) IP Address: (?<src_ip>[\d\.]+)
EXTRACT-hirschmann-rs30-port_up_down = traputil.c\(\d+\) \d+ %% (?<type>Link (Up|Down)): Unit: (?<unit>\d+) Slot: (?<slot>\d+) Port: (?<src_interface>\d+)
EXTRACT-hirschmann-rs30-dot1s_failed = dot1s_ih.c\(\d+\) \d+ %% (?<type>dtlDot1sStateSet failed) intIfNum (?<src_interface>\d+), instance ID (?<instance_id>\d+) state (?<state_id>\d+)
EXTRACT-hirschmann-rs30-sntp_trap = traputil.c\(\d+\) \d+ %% (?<type>hmSNTPTrap):\s+hmNetSNTPOperStatus: (?<state_id>\d+)
EXTRACT-hirschmann-rs30-power_supply_state = traputil.c\(\d+\) \d+ %% (?<type>hmPowerSupply):\s+Index: (?<slot>\d+) State: (?<state>\S+)
EXTRACT-hirschmann-rs30-stp_topology_change = traputil.c\(\d+\) \d+ %% (?<type>Spanning Tree Topology Change): Unit: (?<unit>\d+) Slot: (?<slot>\d+) Port: (?<src_interface>\d+)
EXTRACT-hirschmann-rs30-stp_new_root = traputil.c\(\d+\) \d+ %% (?<type>New Spanning Tree Root): (?<root_id>\d+), Unit: (?<unit>\d+)
EXTRACT-hirschmann-rs30-cold_start = traputil.c\(\d+\) \d+ %% (?<type>Cold Start): Unit: (?<unit>\d+)
EXTRACT-hirschmann-rs30-link_flap = traputil.c\(\d+\) \d+ %% hmPortMonitorTrap caused by (?<type>Link_Flap) :\s+Unit: (?<unit>\d+)\s+Slot: (?<slot>\d+)\s+Port: (?<src_interface>\d+)
EXTRACT-hirschmann-rs30-devmon_state_change = traputil.c\(\d+\) \d+ %% (?<type>hmDevMonStateChange)\((?<state_id>\d+)\):\s+Cause: (?<cause>\S+)
EXTRACT-hirschmann-rs30-fail_logging = traputil.c\(\d+\) \d+ %% (?<type>Failed User Login): Unit: (?<unit>\d+) User ID: (?<user>\S+)?
EXTRACT-hirschmann-rs30-duplex_mismatch = traputil.c\(\d+\) \d+ %% hm(?<type>DuplexMismatch)DetectTrap:\s+Unit: (?<unit>\d+)\s+Slot: (?<slot>\d+)\s+Port: (?<src_interface>\d+)
EXTRACT-hirschmann-rs30-conf_save_change = traputil.c\(\d+\) \d+ %% hm(?<type>Configuration(Saved|Changed))Trap:\s+(AutoconfigAdapterStatus|ConfigurationStatus): (?<state>\S+)
EXTRACT-hirschmann-rs30-snmp_get = dosnmpv3.c\(\d+\) \d+ %% (?<snmp_username>[^:]+)?:(?<type>SNMP)(?<snmp_version>v[1-3]) (?<snmp_action>GET|GETNEXT):(?<oid>\S+)( =)? ?(?<value>.+)?
EXTRACT-hirschmann-rs30-port_sec = traputil.c\(\d+\) \d+ %% (?<type>Port Security) \(auto-disable\):\s+Unit (?<unit>\d+)\s+Slot (?<slot>\d+)\s+Port (?<src_interface>\d+) Connected User (?<src_mac>[\da-f:]+)
EXTRACT-hirschmann-rs30-sfp_change = traputil.c\(\d+\) \d+ %% (?<type>hmSFPChange):\s+SFP: (?<sfp>.+)
EXTRACT-hirschmann-rs30-poe = traputil.c\(\d+\) \d+ %% (?<type>PoE):\s+Unit: (?<unit>\d+)\s+Slot: (?<slot>\d+)\s+Port: (?<src_interface>\d+) power (?<state>\S+)
EXTRACT-hirschmann-rs30-temperature = htraputil.c\(\d+\) \d+ %% hm(?<type>Temperature):\s+Temp: (?<temperature>\d+) Limits: lwr (?<limit_low>-?\d+) upr (?<limit_high>-?\d+)
EXTRACT-hirschmann-rs30-unknown_event = nvstore.c\(\d+\) \d+ %% (?<type>Event)\(0x.+\)
EXTRACT-hirschmann-rs30-self_test_reboot = traputil.c\(\d+\) \d+ %% hm(?<type>SysSelftestRebootOnError)Trap:\s+hmSysSelftestRebootOnError: (?<state_id>\d+)
EXTRACT-hirschmann-rs30-vlan_already_registered = dot1q_api.c\(\d+\) \d+ %% (?<type>VLAN) (?<vlan_id>\d+) already registered by (?<name>\S+)
EXTRACT-hirschmann-rs30-pvid_vlan_not_present = dot1q_api.c\(\d+\) \d+ %% Cannot set (?<type>pvid), Vlan\((?<vlan_id>\d+)\) not present
description = Sourcetype pour Hirschmann RS30/32

[syslog]
TRANSFORMS-sourcetype-hirschmann_rs30 = force_sourcetype_for_hirschmann_rs30