Getting Data In

Juniper Netscreen TCP Syslog messages not breaking properly

JHill
Explorer

We are sending logs in from Juniper Netscreen Firewalls via tcp and Splunk is not properly breaking the logs and it ends up being a long message with multiple logs in the single message.

We have tried source type as syslog and tcp but does not make any difference where the messages are broken up.

I have looked at the source types but I am still not familiar at how to customize them.

Any help would be appreciated.

Tags (2)
2 Solutions

jrodman
Splunk Employee
Splunk Employee

This wants to be a support ticket, with example text for support to work on. It might be as simple as configuring the tcp input to set the sourcetype.

View solution in original post

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You also might need to set a line breaker defined in your sourcetype as follows $SPLUNK_HOME/etc/system/local/inputs.conf

[tcp://9999]
sourcetype = juniper_syslog_stuff

And In your $SPLUNK_HOME/etc/system/local/props.conf

[junpiper_syslog_stuff]
LINE_BREAKER=(\x00)<\d+>
SHOULD_LINEMERGE=False

View solution in original post

markushass
New Member

Hi,

i just started evaluating splunk... and i just ran into this same issue. However it looks like the settings in the props.conf are somehow ignored. There is still one big message that is not split by the \x00 string.

Any suggestions...? Im running splunk 5.0.1 build 143156

Best regards,

Markus

0 Karma

jspears
Communicator

We just started seeing the same problem when we switched to using TCP for the Netscreens. FWIW, if you're relaying through rsyslog you can fix it there.

http://www.rsyslog.com/doc/imtcp.html

0 Karma

dskillman
Splunk Employee
Splunk Employee

I haven't seen issues with Netscreen data. Did you make any tweaks to the base Netscreen config? Can you send a few lines over if non of these previous answers worked?

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You also might need to set a line breaker defined in your sourcetype as follows $SPLUNK_HOME/etc/system/local/inputs.conf

[tcp://9999]
sourcetype = juniper_syslog_stuff

And In your $SPLUNK_HOME/etc/system/local/props.conf

[junpiper_syslog_stuff]
LINE_BREAKER=(\x00)<\d+>
SHOULD_LINEMERGE=False

BunnyHop
Contributor

I would try creating your own sourcetype. Is there a timestamp either at the beginning or the end of the line? If so, you can call for the timestamp to be the basis of the linebreak. If not, by default, the SHOULD_LINEMERGE attribute is set to false. This merges multiple lines into a single event. Set this to your props.conf file. Make sure you create a props.conf file within the %SPLUNK%/etc/system/local/ directory. Restart your splunk instance once you add this, and make sure that the sourcetype for your Juniper log is set to juniper_syslog, as specify below.

props.conf

[juniper_syslog] SHOULD_LINEMERGE = false

0 Karma

jrodman
Splunk Employee
Splunk Employee

This wants to be a support ticket, with example text for support to work on. It might be as simple as configuring the tcp input to set the sourcetype.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...