This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Syslog output view

I am using KIWI to view the syslog of a Meraki MX84 security Appliance.

The output of the log file is difficult to read, as all the necessary information is in the message box, and it is just one long message.

    

3/21/2018 6:18Local0.Info10.0.2.25

1 1521627538.568617081 Shelton_Town_Hall_Firewall urls src=192.168.10.227:51564 dst=204.79.197.200:443 mac=58:F3:9C:8D:38:07 request: UNKNOWN https://www.bing.com/...

Is there any way to break down the message line, or at least extract the SRC=x.x.x.x from it, and when I view it in excel, have the SRC be it's own column, so that I can view and sort easier?

Any help that anyone can offer would be greatly appreciated!!!

Thank you

  • You will need to create a script(Vbscript) and add a run script action.  There is an example file included with the installation called 'Script_SplitMessageInfoFields.txt' that should get you started.

    It's hard to tell in the posting but splitting the message on the space character as done in the example will probably work.  If not using '=' will work to get you the field separation you are looking for.

  • It seems scripting is only available in the paid version.  I am not opposed to buying it once I know it will do what I want.  However without being able to test, I think I might be back square one.  Do you have any suggestions?

  • The trial version may allow you to test for 14 days.

    The application can do what you are looking for.  We have dozens of similar scripts running that take the existing message, parse it, and write a new message.

  • ok.  so I am missing something here.  I am not good with scripts so bear with me please.  I got the included split message script to load in the schedule.  When I select Run Now it seems to accept it, but I never get a finished notification and I never get any output in the directory I selected.  What the heck am I doing wrong here..  I don't even see where I can test the script to see if it even works.

  • The script should be added to the rule not a schedule.  When the message arrives at the Kiwi server the rule will match the message and one of the actions will be to run the script.

  • open the file in notepad

    replace src= with ,scr=

    save the file

    open in excel and the scr= will be in its own column