Release 2008.2
8
Writing a Complete
Extension Document
The example of an extension document included in this section provides
information on how to parse one particular type of Cisco FWSM so that events are
not sent with an incorrect event name. For example, if you wish to resolve the word
session
, which is embedded in the middle of the event name:
Nov 17 09:28:26 129.15.126.6 %FWSM-session-0-302015: Built UDP
connection for faddr 38.116.157.195/80 gaddr
129.15.127.254/31696 laddr 10.194.2.196/2157 duration 0:00:00
bytes 57498 (TCP FINs)
This condition causes the DSM to not recognize any events and all the events are
un-parsed and associated with the generic logger.
Although only a portion of the text string (
302015
) is used for the QID search, the
entire text string (
%FWSM-session-0-302015
) identifies the event as coming from
a Cisco FWSM. Since the entire text string is invalid, the DSM assumes that the
event is invalid.
A FWSM device has a large number of event types, many with unique formats.
The following extension document example, indicates how to parse one event
type.
The pattern IDs do not have to match the field names that they are parsing. Even
though the following example duplicates the pattern, the
SourceIp
field and the
SourceIpPreNAT
field could use the exact same pattern in this case (this may not
be true in all FWSM events).
<?xml version="1.0" encoding="UTF-8"?>
<device-extension xmlns="event_parsing/device_extension">
<pattern id="EventNameFWSM" xmlns=""><![CDATA[%FWSM[a-zA-Z\-]*\d-(\d{1,6})]]></pattern>
<pattern id="SourceIp" xmlns=""><![CDATA[gaddr
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>
<pattern id="SourceIpPreNAT" xmlns=""><![CDATA[gaddr
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>
<pattern id="SourceIpPostNAT" xmlns=""><![CDATA[laddr
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>
<pattern id="DestinationIp" xmlns=""><![CDATA[faddr
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>
<pattern id="Protocol" case-insensitive="true"
xmlns=""><![CDATA[(tcp|udp|icmp|gre)]]></pattern>
<pattern id="Protocol_6" case-insensitive="true" xmlns=""><![CDATA[ protocol=6]]></pattern>
<pattern id="EventNameId" xmlns=""><![CDATA[(\d{1,6})]]></pattern>
<match-group order="1" description="FWSM Test" device-type-id-override="6" xmlns="">
<matcher field="EventName" order="1" pattern-id="EventNameFWSM" capture-group="1"/>
<matcher field="SourceIp" order="1" pattern-id="SourceIp" capture-group="1" />
<matcher field="SourcePort" order="1" pattern-id="SourceIp" capture-group="2" />
<matcher field="SourceIpPreNAT" order="1" pattern-id="SourceIpPreNAT" capture-group="1" />
<matcher field="SourceIpPostNAT" order="1" pattern-id="SourceIpPostNAT" capture-group="1" />
<matcher field="SourcePortPreNAT" order="1" pattern-id="SourceIpPreNAT" capture-group="2" />
<matcher field="SourcePortPostNAT" order="1" pattern-id="SourceIpPostNAT" capture-group="2" />
<matcher field="DestinationIp" order="1" pattern-id="DestinationIp" capture-group="1" />
