Getting Data In
Highlighted

Juniper Netscreen TCP Syslog messages not breaking properly

Explorer

We are sending logs in from Juniper Netscreen Firewalls via tcp and Splunk is not properly breaking the logs and it ends up being a long message with multiple logs in the single message.

We have tried source type as syslog and tcp but does not make any difference where the messages are broken up.

I have looked at the source types but I am still not familiar at how to customize them.

Any help would be appreciated.

Tags (2)
Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

Splunk Employee
Splunk Employee

This wants to be a support ticket, with example text for support to work on. It might be as simple as configuring the tcp input to set the sourcetype.

View solution in original post

0 Karma
Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

Contributor

I would try creating your own sourcetype. Is there a timestamp either at the beginning or the end of the line? If so, you can call for the timestamp to be the basis of the linebreak. If not, by default, the SHOULD_LINEMERGE attribute is set to false. This merges multiple lines into a single event. Set this to your props.conf file. Make sure you create a props.conf file within the %SPLUNK%/etc/system/local/ directory. Restart your splunk instance once you add this, and make sure that the sourcetype for your Juniper log is set to juniper_syslog, as specify below.

props.conf

[juniper_syslog] SHOULD_LINEMERGE = false

0 Karma
Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

Splunk Employee
Splunk Employee

You also might need to set a line breaker defined in your sourcetype as follows $SPLUNK_HOME/etc/system/local/inputs.conf

[tcp://9999]
sourcetype = juniper_syslog_stuff

And In your $SPLUNK_HOME/etc/system/local/props.conf

[junpiper_syslog_stuff]
LINE_BREAKER=(\x00)<\d+>
SHOULD_LINEMERGE=False

View solution in original post

Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

Splunk Employee
Splunk Employee

I haven't seen issues with Netscreen data. Did you make any tweaks to the base Netscreen config? Can you send a few lines over if non of these previous answers worked?

0 Karma
Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

Communicator

We just started seeing the same problem when we switched to using TCP for the Netscreens. FWIW, if you're relaying through rsyslog you can fix it there.

http://www.rsyslog.com/doc/imtcp.html

0 Karma
Highlighted

Re: Juniper Netscreen TCP Syslog messages not breaking properly

New Member

Hi,

i just started evaluating splunk... and i just ran into this same issue. However it looks like the settings in the props.conf are somehow ignored. There is still one big message that is not split by the \x00 string.

Any suggestions...? Im running splunk 5.0.1 build 143156

Best regards,

Markus

0 Karma