All Apps and Add-ons

Linux DHCP new regex,New dhcp log format

nocsolcon
Explorer

We've upgraded our DHCP server to debian 9. Now the dhcp log is written differently then on our old server
log lines contains now: dhcpd[1569]: instead of dhcpd:

Jul 18 09:12:43 dhcp-server-name dhcpd[1569]: DHCPACK on ip-address to 00:00:00:00:00:00 (modem-type) via ip-address

the app: Linux DHCP can not handle this

can we change the regex in transform.conf

from:
\s(dhcpd):\s

to:
\sdhcpd(:\s|[\d+]:\s)

or should we change more? I tested it, but this change to transform.conf does not work

0 Karma

FrankVl
Ultra Champion

Try escaping those [ ] characters. They have special meaning in regular expressions, so if you want to match actual brackets, they need to be escaped: \sdhcpd(\:\s|\[\d+\]\:\s) https://regex101.com/r/pRwz3z/1

nocsolcon
Explorer

I've fixed it by changing all the regex in the transforms.conf

from:

\s(dhcpd)\:\s

to:

 \sdhcpd(\:\s|\[\d+\]:\s)

Also we need to change the file: eventtypes.conf

from:

[dhcpd_event]
search = process=dhcpd

to:

[dhcpd_event]
search = dhcpd

After this, it is working for the old and new log lines

0 Karma

FrankVl
Ultra Champion

Why the double backslashes?

0 Karma

nocsolcon
Explorer

Sorry, my mistake. I changed it.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...