RSA NW log parser issue - postgresqlmsg

[MaximMarchenko]

Hello.

Need assist with parser work issue.
I've modifyied original parser of postgres using -custom.xml method (postgresqlmsg-custom.xml): modified/added some Messages.
 
For example: 

<?xml version="1.0" encoding="ISO-8859-1" ?>

<DEVICEMESSAGES

    name="postgresql"

    displayname="PostgreSQL"

    group="Database">

<VERSION

        xml="29"

        checksum="0df2e10151dbc7b76fb2f188fd05b683"

        revision="135"

        device="2.0"/>

<MESSAGE

    id1="authentication:100"

    id2="authentication"

    insertBefore="authentication"

    eventcategory="1609000000"

    functions="&lt;@ec_subject:Database&gt;&lt;@ec_theme:DB-Connection&gt;&lt;@ec_outcome:Failure&gt;&lt;@msg:*PARMVAL($MSG)&gt;&lt;@:*SYSVAL($MSGID,$ID1)&gt;&lt;@event_time:*EVNTTIME($MSG,'%W-%G-%F %N:%U:%O',fld5,fld8)&gt;&lt;@starttime:*EVNTTIME($MSG,'%W-%G-%F %N:%U:%O',fld6,fld9)&gt;&lt;@obj_name:*PARMVAL(db_name)&gt;&lt;@ec_activity:*PARMVAL(severity)&gt;"

    content="&lt;fld1&gt;[&lt;process_id&gt;]: [&lt;fld2&gt;-&lt;fld3&gt;] #PostGreSQL: &lt;fld4&gt;^^&lt;fld5&gt; &lt;fld8&gt; &lt;timezone&gt;^^&lt;username&gt;^^&lt;db_name&gt;^^{ [&lt;saddr&gt;]^^ | &lt;saddr&gt;(&lt;sport&gt;)^^ }&lt;sessionid&gt;^^&lt;fld6&gt; &lt;fld9&gt; &lt;fld10&gt;^^&lt;severity&gt;: password authentication failed &lt;fld11&gt;" />

</DEVICEMESSAGES>

Log Parser Tool (using modified parser) shows everything OK, as I expect.
 
I load it to the LogDecoder: /etc/netwitness/ng/envision/etc/devices/postgresqlmsg-custom.xml

and run parser reload command:
NwConsole -c login localhost:56002:ssl admin <password> -c decoder/parsers reload
RSA NetWitness NextGen Console 11.5.2.0
Copyright 2001-2020, RSA Security Inc. All Rights Reserved.
>login ...
Successfully logged in to localhost:56002 as session 1966977
>decoder/parsers reload
The parsers have been reloaded
 
After that I generate neccessary event and find for it in Investigate.
I get bunch of metas like "word" with no messageid for Message that I want.

header.id is "0004" - it's correct.

Without any -custom.xml file result is the same.

Modifiying original parser - result is the same.

[MaximMarchenko]

Raw log example:

Mar 12 11:05:30 test-db postgres[5896]: [4-1] #PostGreSQL: authentication^^2021-03-12 11:05:30 ALMT^^parsing_user^^parsing^^192.168.0.1(49442)^^604af69a.1708^^2021-03-12 11:05:30 ALMT^^FATAL: password authentication failed for user "parsing_user"

[braydengreen]

Hi @MaximMarchenko ,

I was searching through the forums to clean them up and I noticed yours here in the general forum.  Have you received an answer to your question? If not I could move this to the NetWitness specific forum where subject matter experts would be able to help out, and if that doesn't get your answer we could alternatively open up a support case for you.

[MaximMarchenko · Accepted solution]

Hi.

No, I have not, but I've handled it by myself.