Calculate any Server network throughput from Cisco ASA logs.

[Hami-g]

I can see logs from Cisco ASA firewall to Splunk and we are getting logs when a connection close. It have the total data send with bytes. 

Nov 1 12:19:48 ASA-FW-01 : %ASA-6-302014: Teardown TCP connection 4043630532 for INSIDE-339:192.168.42.10/37308 to OUTSIDE-340:192.168.36.26/8080 duration 0:00:00 bytes 6398 TCP FINs from INSIDE-VLAN339

I am unable to see bytes as a valid field.  I tried to create Extract New Fields for this. 

^(?:[^:\n]*:){8}\d+\s+(?P<BYTES>\w+\s+)

But when I use in the search it fails. 

index=asa_* src_ip = "192.168.42.10"  | rex field=_raw DATA=0 "^(?:[^:\n]*:){8}\d+\s+(?P<BYTES>\w+\s+)"

OBJECTIVE :  Calculate Server throughput for flows using Cisco ASA logs.   So view the network throughput for the flows using splunk. 

[gcusello]

Hi @Hami-g ,

you regex isn't correct, please try this:

^(?:[^:\n]*:){8}\d+\s+bytes\s(?P<BYTES>\w+\s+)

that you can test at https://regex101.com/r/BGPGr9/1

Ciao.

Giuseppe

[tscroggins]

Hi @Hami-g,

Splunk Add-on for Cisco ASA provides the recommended knowledge objects for message 302014:

| eval bytes_per_second=bytes/duration

Specifically, the add-on includes a transform for field extractions and a field for duration:

# transforms.conf

[cisco_asa_message_id_302014_302016]
REGEX = -30201[46]:\s*(\S+)\s+(\S+)\s+connection\s+(\d+)\s+for\s+([^:\s]+)\s*:\s*(?:((?:[\d+.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_@\.]+)\s*\))?\s+to\s+([^:\s]+)\s*:\s*(?:((?:[\d+.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_]+)\s*\))?\s+[Dd]uration:?\s*(?:(\d+)[dD])?\s*(\d+)[Hh]?\s*:\s*(\d+)[Mm]?\s*:\s*(\d+)[Ss]?\s+bytes\s+(\d+)\s*(?:(.+?(?=\s+from))\s+from\s+(\S+)|([^\(]+))?\s*(?:\(\s*([^\)\s]+)\s*\))?
FORMAT = action::$1 transport::$2 session_id::$3 src_interface::$4 src_ip::$5 src_host::$6 src_port::$7 src_nt_domain::$8 src_user::$9 dest_interface::$10 dest_ip::$11 dest_host::$12 dest_port::$13 dest_nt_domain::$14 dest_user::$15 duration_day::$16 duration_hour::$17 duration_minute::$18 duration_second::$19 bytes::$20 reason::$21 teardown_initiator::$22 reason::$23 user::$24

# props.conf

[cisco:asa]
# ...
EVAL-duration = ((coalesce(duration_day, 0))*24*60*60) + (duration_hour*60*60) + (duration_minute*60) + (duration_second)