dlink log extraction

[javier_reina]

Hello,

we are trying to parse logs from a dlink DXS-3600 but we are not able to find the correct format, we have tried with several versions of syslog but it does not work.

Does anyone know what format these logs are in?

Oct 15 15:36:04 10.68.16.16 Oct 15 13:36:04 10.68.16.16 INFO: Successful login through Web (Username: Gestion, IP: 10.168.0.53)
Oct 15 15:41:45 10.68.16.16 Oct 15 13:41:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:13 10.68.16.16 Oct 15 13:42:14 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:33 10.68.16.16 Oct 15 13:42:34 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)
Oct 15 15:42:44 10.68.16.16 Oct 15 13:42:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)

Greetings

[richgalloway]

If you can't find an existing format that works then just create your own.  It's not that hard.  Start by putting this in your props.conf file.

[dlink]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 15
TZ = UTC
EXTRACT-loglevel = \d\d\.\d\d\s(?<log_level>\w+):
EXTRACT-username = Username:\s(?<username>\w+)

Adjust the value of the TZ setting to match the time zone of the source.  Add more EXTRACT lines to pull more fields.