Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

data is not going to defined sourcetype- Previous ticket #2510 #2513

Closed
imsidr opened this issue Jun 27, 2024 · 9 comments
Closed

data is not going to defined sourcetype- Previous ticket #2510 #2513

imsidr opened this issue Jun 27, 2024 · 9 comments
Assignees
@cwadhwani-splunk

Comments

@imsidr
Copy link

imsidr commented Jun 27, 2024

Was the issue replicated by support?

What is the sc4s version ? 3.19.0

Which operating system (including its version) are you using for hosting SC4S? docker container

Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S? docker

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?

Is the issue related to the environment of the customer or Software related issue? Not Sure

Is it related to Data loss, please explain ?
Protocol? Hardware specs?

Last chance index/Fallback index? sc4s index

Is the issue related to local customization? Not sure

Do we have all the default indexes created? NA
Describe the bug - the sourcetype is not the same as defined in parser. the data is ending up in cisco:ise:syslog sourcetype and i dont have any poc:syslog sourcetype configured but i see data for that too

block parser app-dest-cisco_ise-postfilter() {
channel {
rewrite {
r_set_splunk_dest_default(
index("cisco")
sourcetype('cisco:ise')
vendor("cisco")
product("ise")
);
};
};
};
application app-dest-cisco_ise-postfilter[sc4s-postfilter] {
filter {
host("ise*" type(glob) flags(ignore-case));
};
parser { app-dest-cisco_ise-postfilter(); };
};
@imsidr imsidr changed the title data is not going to defined sourcetype data is not going to defined sourcetype- Previous ticket #2510 Jun 27, 2024
@cwadhwani-splunk
Copy link
Collaborator

cwadhwani-splunk commented Jun 28, 2024 •
edited
Loading

@imsidr
Can we please get sample logs or the pcap file to find the root cause. Also, did you get a chance to open a support ticket for this as mentioned by Rahul in the previous case?
You can share the sample logs to [email protected]

@imsidr
Copy link
Author

imsidr commented Jun 28, 2024 via email

@imsidr
Copy link
Author

imsidr commented Jun 28, 2024

@cwadhwani-splunk case #[3514354]

@imsidr
Copy link
Author

imsidr commented Jun 28, 2024 via email

@cwadhwani-splunk
Copy link
Collaborator

cwadhwani-splunk commented Jul 1, 2024 •
edited
Loading

Hi @imsidr
I added all the parsers (including the ones present in the attached zip) that you have provided in the issue and also made the changes that were suggested in the same ticket. Then, I tried to send a few logs from the PCAP file that you have shared and observed that all the events are ending up in sourcetype=cisco:ise (since the host for all the logs was starting with ise)
Could you please share the whole local folder (Path: /opt/sc4s/local) so that we can look if there is anything else that could cause such behaviour? Please attach it in this GitHub issue.

@imsidr
Copy link
Author

imsidr commented Jul 2, 2024

syslog (2).zip

@cwadhwani-splunk
Copy link
Collaborator

Hi @imsidr
Just extracted the provided zip and observed that the parser present in the file app-dest-cisco_ise.conf is different from the parser provide by us in the previous issue (or the one that you have mentioned in the description). The sourcetype mentioned in the current parser is cisco:ise:syslog.

Here is the screenshot of the app-dest-cisco_ise.conf file present in your current local folder:

image

Please change the sourcetype to cisco:ise as mentioned in the previous issue.

@imsidr
Copy link
Author

imsidr commented Jul 2, 2024 via email

@cwadhwani-splunk cwadhwani-splunk self-assigned this Jul 2, 2024
@cwadhwani-splunk
Copy link
Collaborator

Hi @imsidr

We have replicated a parser of cisco ise postfilter on our local environment. We have used sc4s version 3.19.0 and docker runtime environment and tested the parser by sending sample logs to the splunk. We found that the parser is properly working on our local environment and applying on the sample logs properly. It’s showing sourcetype as “cisco:ise” as per the postfilter parser.

Below are the details
Sample log:

<178>Jun 28 10:51:34 ise-test-host CISE_Alarm CRITICAL: Queue Link Error: Message=From ise-test-10.lmig.com To ise-test1.lmig.com; Cause={tls_alert;{unknown_ca;"tls Client: In State Certify At Ssl_handshake.erl:1887 Generated Client Alert: Fatal - Unknown Ca\n"}

Local Parser:

block parser app-dest-cisco_ise-postfilter() {                                                                        
    channel {                                                                                                         
        rewrite {                                                                                                     
            r_set_splunk_dest_default(                                                                                
                index("cisco")                                                                                        
                sourcetype("cisco:ise")                                                                               
                vendor("cisco")                                                                                       
                product("ise")                                                                                        
            );                                                                                                        
        };                                                                                                            
    };                                                                                                                
};                                                                                                                    
                                                                                                                      
application app-dest-cisco_ise-postfilter[sc4s-postfilter] {                                                          
    filter {                                                                                                          
        host("ise*" type(glob) flags(ignore-case));                                                                   
    };                                                                                                                
    parser { app-dest-cisco_ise-postfilter(); };                                                                      
};

Here is how the event looks like on the Splunk side:
image

If you are still facing this same issue, could you please send us the sc4s_tags field from the Splunk event. Also, please attach the screenshot of the sample splunk event (like I did here) and the latest /opt/sc4s/local folder in the support case.

Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cwadhwani-splunk cwadhwani-splunk

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@imsidr @cwadhwani-splunk