dlink log extraction

javier_reina — Thu, 15 Oct 2020 15:22:22 GMT

Hello,

we are trying to parse logs from a dlink DXS-3600 but we are not able to find the correct format, we have tried with several versions of syslog but it does not work.

Does anyone know what format these logs are in?

Oct 15 15:36:04 10.68.16.16 Oct 15 13:36:04 10.68.16.16 INFO: Successful login through Web (Username: Gestion, IP: 10.168.0.53)
Oct 15 15:41:45 10.68.16.16 Oct 15 13:41:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:13 10.68.16.16 Oct 15 13:42:14 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:33 10.68.16.16 Oct 15 13:42:34 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)
Oct 15 15:42:44 10.68.16.16 Oct 15 13:42:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)

Greetings

Re: dlink log extraction

richgalloway — Thu, 15 Oct 2020 17:33:18 GMT

If you can't find an existing format that works then just create your own. It's not that hard. Start by putting this in your props.conf file.

[dlink] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT = %b %d %H:%M:%S TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 15 TZ = UTC EXTRACT-loglevel = \d\d\.\d\d\s(?<log_level>\w+): EXTRACT-username = Username:\s(?<username>\w+)

Adjust the value of the TZ setting to match the time zone of the source. Add more EXTRACT lines to pull more fields.

topic Re: dlink log extraction in Splunk Search

dlink log extraction

Re: dlink log extraction