You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
4.9 KiB
51 lines
4.9 KiB
[alcatel_omniswitch]
|
|
#Generic
|
|
EXTRACT-alcatel_omniswitch-generic1 = (?<device_time>\S+\s+\d{1,2} \d{2}:\d{2}:\d{2}) (?<reported_hostname>\S+)\s+(<\d+>\S+\s+\d{1,2} \d{2}:\d{2}:\d{2} )?(?<facility>[A-Za-z0-9\.]+)(:|\[\d+\]|\s*\+\+\+)?\s*(?<message_text>.*)
|
|
EXTRACT-alcatel_omniswitch-generic2 = (?<device_time>\S+\s+\d{1,2} \d{2}:\d{2}:\d{2}) (?<facility>[A-Za-z0-9\.]+) \[[0-9\.]+\] (?<mnemonic>\S+)( \(\d+\)|:)\s*(?<message_text>.*)
|
|
EXTRACT-alcatel_omniswitch-generic-swlogd = swlogd\s+(?<mnemonic>\S+)\s+(?<service>\S+)\s+((?<sub_service>[^:\s]+)\s+)?(?<severity_name>\S+):\s+(?<message_text>.*)
|
|
EXTRACT-alcatel_omniswitch-generic-ConsLog1 = ConsLog (\S+\s+\S+\s+\d{1,2} \d{2}:\d{2}:\d{2}) : (?<mnemonic>\S+)\s+(?<service>\S+)\s+(?<severity_name>\S+):?\s+(?<message_text>.*)
|
|
EXTRACT-alcatel_omniswitch-generic-Conslog2 = ConsLog \+\+\+ (?<mnemonic>\S+):\s+(?<message_text>.*)
|
|
#dest ip,port,mac
|
|
EXTRACT-alcatel_omniswitch-to_ip_port = to (?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(?<dest_port>\d+))?(/(?<dest_mac>[0-9a-fA-F:]{17}))?
|
|
#Conslog
|
|
EXTRACT-alcatel_omniswitch-message_severity = (?<severity_name>WARN|INFO|ERR(OR)?) message:
|
|
#MIP_GATEWAY
|
|
EXTRACT-alcatel_omniswitch-client = Client (?<vendor_action>(un)?available)
|
|
#ChassisSupervisor
|
|
EXTRACT-alcatel_omniswitch-copy_file = Copy (?<src>\S+) to (?<dest>\S+) (?<vendor_action>succeeded|failed)
|
|
EXTRACT-alcatel_omniswitch-process_action = process (completed )?(?<vendor_action>successfully|started)
|
|
#flashManager
|
|
EXTRACT-alcatel_omniswitch-compareResult = compareResult \((?<result>\d+)\)
|
|
EXTRACT-alcatel_omniswitch-calling_system = calling system\((?<command>.+)\)
|
|
EXTRACT-alcatel_omniswitch-executing = executing (?<command>.+)
|
|
EXTRACT-alcatel_omniswitch-file_not_found = File (?<file_name>\S+) (?<vendor_action>(not )?found)
|
|
EXTRACT-alcatel_omniswitch-renamed_copy_file = (?<vendor_action>renamed|copying) file (?<file_name>\S+)( size (?<file_size>\d+))?
|
|
EXTRACT-alcatel_omniswitch-saving_file = (?<vendor_action>Saving) the (?<file_name>\S+) file
|
|
EXTRACT-alcatel_omniswitch-listening_directory = listing master directory contents (?<command>.+)
|
|
#intfCmm
|
|
EXTRACT-alcatel_omniswitch-sfp_direction = SFP/XFP (?<direction>[RT]x)
|
|
EXTRACT-alcatel_omniswitch-cmm_esm_link_status_chg = (?<direction>[RT]x) CMM_ESM_LINK_STATUS_CHG from chassis (?<chassis>\d+) NI (?<NI>\d+)
|
|
EXTRACT-alcatel_omniswitch-sfp_conf_msgid = chassis (?<chassis>\d+) zslot (?<zslot>\d+) zport (?<zport>\d+) Txed conf msgId:(?<msgId>\d+)
|
|
EXTRACT-alcatel_omniswitch-direction = (?<direction>[RT]x)(ing|ed)\s+
|
|
EXTRACT-alcatel_omniswitch-link_up_down = Link (?<interface>\S+) (Alias (?<alias>.*) )?operationally (?<vendor_action>up|down)
|
|
EXTRACT-alcatel_omniswitch-port_threshold = CUSTLOG CMM Port (?<interface>\S+) (?<vendor_action>falling) below (?<direction>receive/transmit) threshold
|
|
#portMgrNi
|
|
LINKSTS (?<interface>\S+) (?<vendor_action>UP|DOWN) \(gport (?<gport>\S+)\) Speed (?<speed>\d+) Duplex (?<duplex>)
|
|
#SES
|
|
EXTRACT-alcatel_omniswitch-cli_log = CLI log, user: (?<user>\S+) \((?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\), cmd: (?<command>.+), result: (?<vendor_action>[A-Za-z]+)(:? (?<cause>.+))?
|
|
EXTRACT-alcatel_omniswitch-login_by = Login by (?<user>\S+) from (?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) through (?<protocol>\S+) (?<vendor_action>Success|Failed)
|
|
EXTRACT-alcatel_omniswitch-authentication = Authentication (?<vendor_action>failure) detected: user (?<user>\S+)
|
|
#sshd
|
|
EXTRACT-alcatel_omniswitch-received_authent = Received (keyboard-interactive/pam|password) for (?<user>\S+) from (?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?<src_port>\d+) (?<protocol>[A-Za-z]+)(?<protocol_version>[\d\.]+)?
|
|
EXTRACT-alcatel_omniswitch-proposal_mac = PROPOSAL_MAC_ALGS_CTOS = (?<PROPOSAL_MAC_ALGS_CTOS>\S+)
|
|
EXTRACT-alcatel_omniswitch-proposal_enc = PROPOSAL_ENC_ALGS_CTOS = (?<PROPOSAL_ENC_ALGS_CTOS>\S+)
|
|
#
|
|
EXTRACT-alcatel_omniswitch-dos_type_invalid = (VRF (?<vrf>\S+):\s*)?DoS type invalid ip from (?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/(?<src_mac>[0-9a-fA-F:]{17}) on port (?<src_interface>\S+)
|
|
EXTRACT-alcatel_omniswitch-dos_detected = Denial of Service attack detected:\s*(?<attack_type>.+)
|
|
#intfNi
|
|
EXTRACT-alcatel_omniswitch-eniApplyConfig = eniApplyConfig: cmd:(?<cmd>\d+) zport:(?<zport>\d+) cmdHy:(?<cmdHy>\d+), apMedia:(?<apMedia>\d+)
|
|
EXTRACT-alcatel_omniswitch-niEsmSendLinkStatusChgMsg = niEsmSendLinkStatusChgMsg\(\d+\): linkstatus (?<vendor_action>UP|DOWN)
|
|
#
|
|
EXTRACT-alcatel_omniswitch-port_violation1 = Violation (?<vendor_action>clear), chass (?<chassis>\d+), slot (?<slot>\d+), port (?<interface>\d+): source (?<vendor_source>.*), reason (?<reason>.*)
|
|
EXTRACT-alcatel_omniswitch-port_violation_clear = Port (?<interface>\S+) violation (?<vendor_action>cleared) - (source (?<vendor_source>\S+) )?reason (?<reason>.*)
|
|
EXTRACT-alcatel_omniswitch-port_violation2 = Port (?<interface>\S+) (?<vendor_action>in violation) - (source (?<vendor_source>\S+) )?reason (?<reason>.*) |