How apply a parser for a device

[Anonymous]

Hi,

I have some logs from a Red-Hat server which are interpreted as Big-IP logs.

How can I configure my Log Decoder to use only one specific parser for a specific device IP?

(I must keep the Big-IP Parser...)

Thanks!

[Anonymous]

I would also love to know this.  I have resorted to reparsing with in rhlinux just to get around it. 

[huanzhou1]

you can drill down like this: device.ip='xxx' && device.type='rhlinux'

i don't think there is configuration for the parser, unless modify the parser.

[Anonymous]

Is it really impossible to do something like this on Log Decoder (pseudo code) :

if device.ip == (10.0.0.1|10.0.0.2|10.0.0.3) {

     parser = redhat

} else if  device.ip in 10.0.1.0/34 {

     parser = cisco

} else {

     try all parsers...

}

[huanzhou1]

i don't see this function. maybe can check with support and raise a feature request.

[RSAAdmin]

Hi,

I have the same issue.

As a workaround I would recommend only to turn on parsers that you actually need on decoder as lots of syslogs look the same and SA can misinterpret it.

In Envision we had a possibility to change device type if it was misinterpreted and force use of specific parser. Here we have tons of "multi-device" (lot's of different event sources on one ip) because lots of log look the same. For example I have one device with types: bigip, rhlinux, junosrouter and in fact it's a rhlinux. If rhlinux parser cannot parse this log I would prefer it to be unknown (unparsed) not to mislead reports and investigations.

The feature you're talking about, or interpretation of envision possibilities would be really great.

[Anonymous]

That appears to be the only option currently.  I also have been adding new headers/parsers to linux to take care of the outliers (mostly bigip) then giving them distinct messageids that I can track. 

[Anonymous · Accepted solution]

Solution : Map IP Address to Device Type - RSA Security Analytics Documentation

[Kamarul]

Why I can't access this link: https://sadocs.emc.com/0_en-us/095_10.3_User_Guide/13_Device_and_Service_Configuration/30_Decoder_and_Log_Decoder_CG/Map_IP_Address_to_Device_Type ?

[VarunPrabhakar]

Hello Kamarul,

The document you're referring to is no longer available, please refer to the steps below:

Follow these directions to configure a specific device parser when collecting logs from a given event source. These steps are conducted in the Security Analytics UI as an administrator.
Go to Explore view of the Log Decoder service.

For 11.x, Admin -> Services -> <Log Decoder > -> View -> Explore
Navigate to Decoder -> Parsers.
Right-click Parsers and select Properties.
From the drop-down, select ipdevice.
In the parameters field, enter the following: op=edit entries=+<ip_address>=<parser_name>

Thanks