MonitorWare Knowledge Base

Love the appliance! However, I'm curious as to how well it handles the Cisco IOS log format - the Syslogtag field always displays the syslog line number rather than the actual tag.

Also, I can't figure out how to search for text strings in the messages field.

Thanks!

That's a parsing problem, Cisco IOS does use (as usual...) a non-standard format. Can you supply me with a message sniffed of the wire (e.g. via WireShark)? If so, I can try to upgrade the parser to include it.

For details on this effort, see here:

http://blog.gerhards.net/2009/02/callin ... mples.html

Rainer

rgerhards wrote:That's a parsing problem, Cisco IOS does use (as usual...) a non-standard format. Can you supply me with a message sniffed of the wire (e.g. via WireShark)? If so, I can try to upgrade the parser to include it.

For details on this effort, see here:

http://blog.gerhards.net/2009/02/callin ... mples.html

Rainer

Great. I sent the capture to your gmail account. Thanks!

Or, alternatively, if there's a way I could alter an existing parser myself I'd be happy to if you could clue me in on where it is. Thanks!

sorry, I am sluggish again... You can alter the parser, but that's far from being trivial. So far, we do not have a real parser abstraction in rsyslog. But if you'd like to give it a try, watch for "ParseLegaySyslogMessage" (or so...).

rgerhards wrote:sorry, I am sluggish again... You can alter the parser, but that's far from being trivial. So far, we do not have a real parser abstraction in rsyslog. But if you'd like to give it a try, watch for "ParseLegaySyslogMessage" (or so...).

After poking around, it looks like this is beyond my abilities to figure out at the moment.

If you decide to put together a parser for Cisco logs (which I'm sure would be very useful to many) then please let me know via this forum and I'll revisit the Syslog Appliance. Thanks!