topic Eventia Log Parsing tool tutorial/HowTo in General Topics

Eventia Log Parsing tool tutorial/HowTo

AkosBakos — Fri, 26 May 2023 13:55:55 GMT

Dear Community,

I'm newbie in this tool. I want to parse Juniper logs into SmartCenter.

My first step was successful -> the syslogs have been parsed into the SmartLog. I saw only the RAW syslog in the "Default Device Message" and nothing more.

I created a .C file, where I matched the detected fields one by one with the CP fields.

In the Product identification, I searched for this sting: "RT_FLOW_SESSION_CREATE"

After I wanted to simulate with an another syslog message that contained this sting, the matched fields (src, dst, etc.) weren't recognized.

I thought I made a tiny mistake but it ruins the whole parsing.

Maybe somebody has a .prs file that could share with me?

Akos

Re: Eventia Log Parsing tool tutorial/HowTo

the_rock — Fri, 26 May 2023 19:47:33 GMT

Its been ages since I worked with Juniper device. Are you getting any relevant error as far as logs in mgmt server?

Andy

Re: Eventia Log Parsing tool tutorial/HowTo

AkosBakos — Fri, 26 May 2023 19:59:36 GMT

No error messages. The full syslog message is in that field, thatbI mentioned.

Therefore, I ask for a sample .prs file maybe somebody has one 😉

Akos

Re: Eventia Log Parsing tool tutorial/HowTo

the_rock — Fri, 26 May 2023 20:02:53 GMT

Hopefully someone can provide it.

Cheers,

Andy