Syslog
-
-
A v logah servera nichego net pro oshibki pri starte (naprimer chto ne udalos' sdelat' bind na port 514)? I esche - mozno li prislat' neskol'ko obrazcov soobschenij - esli server ih prinimaet to edinstvennaja prichina po kotoroj oni mogut ne pojavljatsja v loge eto oshibka pri parsinge.
-
Ошибок при старте нет. Порт байндится замечательно. По нетстату его видно.
Образцы какого рода сообщений? Тех что я ловлю в tcpdump или же те, что на оборудовании в логах?
Если на оборудовании, то вот:Nov 9 10:14:32.955: %SYS-5-CONFIG_I: Configured from console by ets on vty0 (IP ADDRESS) Nov 9 10:18:17.149: %SYS-5-CONFIG_I: Configured from console by ets on vty0 (IP ADDRESS) Nov 9 10:42:49.899: %SYS-5-CONFIG_I: Configured from console by ets on vty0 (IP ADDRESS) Nov 9 10:43:23.736: ISDN Dc1/0 SC Q931: TX -> CONNECT pd = 8 callref = 0xCF63 Nov 9 10:43:23.760: ISDN Dc1/0 SC Q931: RX <- CONNECT_ACK pd = 8 callref = 0x4F63 Nov 9 10:43:23.892: ISDN Dc1/0 SC Q931: RX <- DISCONNECT pd = 8 callref = 0x4F66 -
Esli po setke soobschenija prihodjat tochno takie-ze, to pohoze ponjatno. NetXMS server ne rasschitivaet poluchit' timestamp v vide hh:mm:ss.xxx, shitaet chto timestamp plohoj i otbrasivaet soobschenie. A eto standartnij variant kstati? Ja vrode po RFC delal parsing... No v ljubom sluchae dobavlju obrabotku takogo varianta timestamp'a.
-
-
Citata iz RFC3164 (The BSD syslog Protocol), napisana chelovekom iz Cisco:
The HEADER contains two fields called the TIMESTAMP and the HOSTNAME.
The TIMESTAMP will immediately follow the trailing ">" from the PRI
part and single space characters MUST follow each of the TIMESTAMP
and HOSTNAME fields. HOSTNAME will contain the hostname, as it knows
itself. If it does not have a hostname, then it will contain its own
IP address. If a device has multiple IP addresses, it has usually
been seen to use the IP address from which the message is
transmitted. An alternative to this behavior has also been seen. In
that case, a device may be configured to send all messages using a
single source IP address regardless of the interface from which the
message is sent. This will provide a single consistent HOSTNAME for
all messages sent from a device.The TIMESTAMP field is the local time and is in the format of "Mmm dd
hh:mm:ss" (without the quote marks) where:Mmm is the English language abbreviation for the month of the
year with the first character in uppercase and the other two
characters in lowercase. The following are the only acceptable
values:Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec
dd is the day of the month. If the day of the month is less
than 10, then it MUST be represented as a space and then the
number. For example, the 7th day of August would be
represented as "Aug 7", with two spaces between the "g" and
the "7".hh:mm:ss is the local time. The hour (hh) is represented in a
24-hour format. Valid entries are between 00 and 23,
inclusive. The minute (mm) and second (ss) entries are between
00 and 59 inclusive.A single space character MUST follow the TIMESTAMP field.
Ni slova pro vozmoznost' takogo formata.
-
Понимаю но факт остается фактом :(((
Вот не с железки, а с SolarWinds лог:
MsgID Active IP Hostname DateTime Facility Priority Message 1302754 Да MY_IP myhostname 2007-10-10 15:19:01 184 6 15512: Oct 10 11:19:20.614: %SEC-6-IPACCESSLOGP: list 170 denied tcp IP_A(41928) -> MY_IP(22), 1 packetТ.е. судя по тому что я вижу, они не парсят пакет.. А превращают его в обычный string и бросают в лог.
-
Aga, a mi parsim (v osnovnom dlja togo chtobi svjazat' s ob'ektom node), bol'she intellekta - bol'she problem
Zaregistriroval v bugtracker'e kak issue #199, budu ispravljat'. -
-
-
Пока нет, всю неделю не до того было... На выходных займусь.
-
Vrode ispravil. Esli zamenit' prilozennij fail v src/server/core i peresobrat', to dolzno rabotat'.
-
-
-
Пока нельзя. В планах уже давно, но никак руки не доходят...
-
-
-
Я принял к сведению
Конечно, все возможно, и со временем обязательно будет. -
-
Сорри, что поднимаю тему вновь, но честно говоря не совсем понятно как в 0.2.23 отлавливать события пришедшие по Syslog. Можно какой-нить мини-мануальчик хотя бы?
Надо через Control Panel -> Syslog Parser написать XML, где описывается, какие записи в syslog превращать в события. Формат этого XML'a описан здесь: https://www.netxms.org/forum/index.php/topic,483.0.html. Можно указывать или код, или имя события. Потом делается обработка событий как обычно через event processing policy.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login