topic Re: Calculate any Server network throughput from Cisco ASA logs. in Splunk Search

Calculate any Server network throughput from Cisco ASA logs.

Hami-g — Sat, 11 Nov 2023 01:49:42 GMT

I can see logs from Cisco ASA firewall to Splunk and we are getting logs when a connection close. It have the total data send with bytes.

Nov 1 12:19:48 ASA-FW-01 : %ASA-6-302014: Teardown TCP connection 4043630532 for INSIDE-339:192.168.42.10/37308 to OUTSIDE-340:192.168.36.26/8080 duration 0:00:00 bytes 6398 TCP FINs from INSIDE-VLAN339

I am unable to see bytes as a valid field. I tried to create Extract New Fields for this.

^(?:[^:\n]*:){8}\d+\s+(?P<BYTES>\w+\s+)

But when I use in the search it fails.

index=asa_* src_ip = "192.168.42.10" | rex field=_raw DATA=0 "^(?:[^:\n]*:){8}\d+\s+(?P<BYTES>\w+\s+)"

OBJECTIVE : Calculate Server throughput for flows using Cisco ASA logs. So view the network throughput for the flows using splunk.

Re: Calculate any Server network throughput from Cisco ASA logs.

tscroggins — Sat, 11 Nov 2023 02:01:38 GMT

Hi @Hami-g,

Splunk Add-on for Cisco ASA provides the recommended knowledge objects for message 302014:

| eval bytes_per_second=bytes/duration

Specifically, the add-on includes a transform for field extractions and a field for duration:

# transforms.conf

[cisco_asa_message_id_302014_302016]
REGEX = -30201[46]:\s*(\S+)\s+(\S+)\s+connection\s+(\d+)\s+for\s+([^:\s]+)\s*:\s*(?:((?:[\d+.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_@\.]+)\s*\))?\s+to\s+([^:\s]+)\s*:\s*(?:((?:[\d+.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_]+)\s*\))?\s+[Dd]uration:?\s*(?:(\d+)[dD])?\s*(\d+)[Hh]?\s*:\s*(\d+)[Mm]?\s*:\s*(\d+)[Ss]?\s+bytes\s+(\d+)\s*(?:(.+?(?=\s+from))\s+from\s+(\S+)|([^\(]+))?\s*(?:\(\s*([^\)\s]+)\s*\))?
FORMAT = action::$1 transport::$2 session_id::$3 src_interface::$4 src_ip::$5 src_host::$6 src_port::$7 src_nt_domain::$8 src_user::$9 dest_interface::$10 dest_ip::$11 dest_host::$12 dest_port::$13 dest_nt_domain::$14 dest_user::$15 duration_day::$16 duration_hour::$17 duration_minute::$18 duration_second::$19 bytes::$20 reason::$21 teardown_initiator::$22 reason::$23 user::$24

# props.conf

[cisco:asa]
# ...
EVAL-duration = ((coalesce(duration_day, 0))*24*60*60) + (duration_hour*60*60) + (duration_minute*60) + (duration_second)

Re: Calculate any Server network throughput from Cisco ASA logs.

gcusello — Sat, 11 Nov 2023 06:45:43 GMT

Hi @Hami-g ,

you regex isn't correct, please try this:

^(?:[^:\n]*:){8}\d+\s+bytes\s(?P<BYTES>\w+\s+)

that you can test at https://regex101.com/r/BGPGr9/1

Ciao.

Giuseppe