Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to parse some custom (network appliance) syslog files to create my own formatted output.

As I am new to syslog-ng & patterndb I have been trying to build an example using the documentation - my work so far is here: https://gist.github.com/linickx/8002981

In the example, I would like to read the syslog file (testfile.log):

Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2
Accepted password for user from 10.51.0.27 port 4256 ssh2

And output just a list of usernames & ip addresses, like:

sampleuser; 10.50.0.247;
user; 10.51.0.27;

To parse the log file I have created the following patterndb (example.xml):

<patterndb version='4' pub_date='2010-10-17'>
    <ruleset name='ssh' id='123456678'>
        <pattern>ssh</pattern>
            <rules>
                <rule provider='me' id='182437592347598' class='system'>
                    <patterns>
                        <pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                    </patterns>
                    <examples>
                        <example>
                            <test_message program="ssh">Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2</test_message>
                            <test_values>
                                <test_value name="SSH.AUTH_METHOD">password</test_value>
                                <test_value name="SSH_USERNAME">sampleuser</test_value>
                                <test_value name="SSH_CLIENT_ADDRESS">10.50.0.247</test_value>
                                <test_value name="SSH_PORT_NUMBER">42156</test_value>
                            </test_values>
                       </example>
                    </examples>
                </rule>
            </rules>
    </ruleset>
</patterndb>

However when I use the SSH_USERNAME & SSH_CLIENT_ADDRESS variables in my syslog-ng.conf

destination test_output {
        file("/home/nick/output.log"
                template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; \n")
                template_escape(no)
        );
};

--[ full version can been seen in the GIST ]--

The output file (output.log) is empty

; ;
; ;

Is there some hierarchy or special way to use custom or patterndb variables in syslog-ng.conf that I am missing?

Thanks in Advance!

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.