Custom Script to Define Cisco Syslog Message

rypsmith

Ok, here is one I am sure has been done before. But I can't find where or when.

I need a script to define Cisco syslog messages. This needs to be similar to the Cisco PIX/ASA Lookup example script. I tried modifying this script to match other syslog message IDs however I have been unsuccessful.

Basically, I would like to match the text from the right of the % and to the left of the : in the syslog message. Then correlate this data to a predefined explaination and action.

Anyone have any ideas or can maybe point me in the right direction to something that has been done already?

Kuz

I would go with the following approach:

 

1. Create a new Rule "Parse PIX Messages"

Rule "Parse PIX Messages"

Filter

  + Message Text : RegExp -> Include: "^%PIX-"

Action

  + RunScript "Script_Lookup_PIX_message.txt"  (in \<program files>\Syslogd\Scripts)

  + Email *

2. Modify the script "Script_Lookup_PIX_message.txt"

There's a block in the script that looks like this:

Select Case M

  Case "4-209004"

       E = "An IP fragment is malformed. The total size of the reassembled IP packet exceeds the maximum possible size of 65,535 bytes"

  A = "A possible intrusion event may be in progress. If this message persists, contact the remote peer's administrator or upstream provider."

  Case "2-106012"

E = "This is a connection-related message. A IP packet was seen with IP options.  Because IP options are considered a security risk, the packet was discarded."

A = "A security breach was probably attempted. Check the local site for loose source or strict source routing."

 ... {Add more CASE statements here}

 

'E' and 'A' correspond to 'Explanation' and 'Action' and are assigned at the end of the script to "VarCustom01" and "VarCustom02" respectively.

These "Custom Fields' are accessible from the E-mail Action* (ie. Insert message content or counter > Custom Fields > VarCustom01), and can be inserted into the E-mail subject or Message body.

The Custom Fields are also available in the 'Custom file formats' and 'Custom DB formats' if you'd like to use "Log to File" or "Log to Database" actions (respectively) in place of the Email action.

HTH,

-Mike.