syslog message searching

This seemed like it should be an easy one but the solution continues to elude me so please give me a hand if you can...

I'm trying to get an alert going based on syslog messages received. The relevant portions of the message text are the number 208 followed by a tab and then the word SQLSERVERAGENT:

208 SQLSERVERAGENT

I've tried using various ways to present the search terms but the results are usually too broad or nonexistent. I did play with regular expressions a bit but I'm not a pro at them and they didn't seem to work any better. Got any suggestions for me?

Find more posts tagged with

syslog_alert_search_regular_expressions

Accepted answers

sedmo

I usually use something like this for these types of alerts

*208*sqlserveragent*

All comments

lchance

In the tab SYSLOG MESSAGE PATTERN did you use a pattern like this?

*208*, \t, *sqlserveragent*

I've never tried using the TAB (\t) but that's how it is mentioned in Regular Expressions help file. But there again, I even question if a SYSLOG Daemon would send a tab character, but maybe it is possible. Maybe you could try it as just: *208*, *sqlserveragent* unless you have already.

Good Luck!

Quaker

I've tried something similar to this but more in the form

*208 \t sqlserveragent*

since I wanted to find only the specific messages that had the words in that form.

Your suggestion results in me getting overly broad results since it includes anything that has either the number 208 or the word sqlserveragent in the message.

As an fyi, I've also tried *208*.*sqlserveagent* just to find any messages that include both terms but that one doesn't even get me any results.

lchance

I just created a new rule to test and it was successful. Here's my Syslog Message event which I was looking for (some details altered for security reasons).

id=firewall sn=0017C53ECF6C time="2009-11-09 19:07:16 UTC" fw=1.11.25.12 pri=6 c=1024 m=537 msg="Connection Closed" n=0 src=10.7.9.4:51277:X0:test39.test.com dst=10.6.9.3:1025:X1:testc1.test.com proto=tcp/1025 sent=3234 rcvd=630 vpnpolicy="test"

Here's the exact syntax of the SYSLOG MESSAGE PATTERN defined in this rule (which triggered successfully):

*id=firewall*, *msg="Connection Closed"*

Also, I did not have checked USE REGULAR EXPRESSIONS IN THIS RULE and I did have checked all MESSAGE SEVERITY and MESSAGE FACILITY. I don't have anything where I could test for a TAB character inside the Syslog Message.

sedmo

I usually use something like this for these types of alerts

*208*sqlserveragent*

Quaker

It's interesting that my syslog server doesn't find anything at all when I use an adapted version of the message pattern search you used. Below is the basic event for which I'm creating the alert but when I use a search like yours I get no results.

Here's what I used:

*208*, *SQLSERVERAGENT*

and here's the event logged on the syslog server:

fws-TestBranchServer MSWinEventLog 1 Application 325 Mon Nov 09 14:39:56 2009 208 SQLSERVERAGENT Unknown User N/A Warning FWS-SVRTEMPLATE Job Engine SQL Server Scheduled Job 'DB Backup Job for DB Maintenance Plan 'DB Maintenance Plan1'' (0xE1FC4350887D9A4DA3B72174808077FA) - Status: Failed - Invoked on: 2009-11-09 14:39:54 - Message: The job failed. The Job was invoked by User FWS-SVRTEMPLATE\Administrator. The last step to run was step 1 (Step 1). 135

No luck in finding that which seems like the syslog server's search functionality is not working correctly or I'm overlooking something. Seems like it shouldn't be this hard...

Quaker

Now that did the trick! The only change was that it's case sensitive so had to capitalize SQLSERVERAGENT but the search works correctly now, if not exactly as eloquent as I was initially shooting for. Right now I don't care, just happy to get it done and into use--thanks for the help!