topic Re: host_segment being overridden in Getting Data In

host_segment being overridden

tlmayes — Fri, 08 Oct 2021 12:58:36 GMT

I am using the following in a configuration being distributed to several remote syslog servers. Works as expected on all UF's, except 1. From a single UF's, the 'host' field in the indexed events is being reported as "PaloAlto" instead of the 4th segment as expected?

I searched through all of the .conf files on the UF manually and used BTOOL looking for a missed "host_segment" entry or something hidden in another config that would cause this, none found.

Am I am missing something obvious to the rest of you?

[monitor:///app01/logs/ASA] whitelist = .+\.log$ host_segment = 4 index = syn_netfw sourcetype = cisco:asa ignoreOlderThan = 2d disabled = 0 [monitor:///app01/logs/PaloAlto] whitelist = .+\.log$ host_segment = 4 index = syn_netfw sourcetype = pan:log ignoreOlderThan = 2d disabled = 0

Re: host_segment being overridden

somesoni2 — Fri, 08 Oct 2021 13:08:04 GMT

Is the sourcetype assignment correct on the 1 UF?

The host value can be overridden during Event parsing on HF/Indexer, so you may want to check if some TRANSFORM is applied to that sourcetype.

Re: host_segment being overridden

tlmayes — Fri, 08 Oct 2021 17:34:55 GMT

Thanks. Will have to start eliminating Apps until this problem resolves

Re: host_segment being overridden

PickleRick — Sat, 09 Oct 2021 06:35:53 GMT

Are you sure that Palo sends the logs in the format you're expecting? Some solutions name their log sending "syslog" but send something that doesn't conform to any standards.

Re: host_segment being overridden

tlmayes — Sat, 09 Oct 2021 12:12:48 GMT

Sourcetype assignment is distributed as an app from the DS to all UF's, so is 100% identical on all UF's.

Re: host_segment being overridden

tlmayes — Mon, 11 Oct 2021 18:30:49 GMT

Thanks. All data passes directly from the UF to the Indexers. Same process on 4 UF's, but one acting weird 🙄

Re: host_segment being overridden

tlmayes — Wed, 13 Oct 2021 13:21:54 GMT

My mystery continues. On the UF causing the problem. Restatement: Collecting PaloAlto logs from multiple UF's, all via distributed inputs.conf below. (1) UF however is reporting the host as PaloAlto. Searched through all ./apps/* for possible conf that was overwriting of host_segment and none found.

Final test, changed target directory AND inputs.conf below from */logs/PaloAlto to */logs/PA using a name that would not have been used in any transforms, etc. Rules out any offending and hidden renaming of host.

Outcome, the events now show host=PA, even though 'host_segment = 4'