byrsapty
98359c7ca3
Closes the parsing gap the README explicitly called out (no D-Link parsing, no ZTE ONU alarms) plus adds BDCOM GPON and expands Juniper coverage (DDoS, PSU/memory/ASIC hardware faults, LACP/BGP/SNMP, config commit). 58 new rules across 5 vendors, wired into Network Equipment Parsing's stage 0 ahead of the generic_critical_severity fallback. Where the same real-world event is reported by multiple vendors (dying_gasp, onu_offline, optical_low_power, cli_login/cli_logout, config_saved, interface_link_state, lag_state_change), rules share one event_type value so dashboards can aggregate across vendors, same normalization approach as accelppp_interface. Built directly from the user's CSV signature report, not from real device log samples - each rule's description says so explicitly. `when` conditions use plain substring/contains matching on the report's own pattern text to keep classification robust; regex field extraction is only added where the source format is unambiguous. Passed offline checks (JSON validity, every pipeline-referenced rule resolves to a file, all regex patterns compile). Live compilation against a running Graylog instance - which caught 2 real bugs during the dashboard/stream fixes earlier this session - could NOT be completed: the test container went unreachable mid-session. Re-run install-graylog.sh once it's back up to confirm these compile before relying on them.
5 lines
2.8 KiB
JSON
5 lines
2.8 KiB
JSON
{
|
|
"title": "Network Equipment Parsing",
|
|
"description": "Parses Juniper, BDCOM EPON/GPON OLT, ZTE OLT, and D-Link syslog, plus a universal critical-severity fallback",
|
|
"source": "pipeline \"Network Equipment Parsing\"\nstage 0 match either\n rule \"juniper_ntp_unreachable\";\n rule \"juniper_ssh_login_success\";\n rule \"juniper_ssh_login_failed_tagged\";\n rule \"juniper_ssh_failed_password\";\n rule \"juniper_ui_configuration_error\";\n rule \"juniper_chassis_alarm\";\n rule \"olt_privilege_mode\";\n rule \"olt_cli_logout\";\n rule \"olt_ip_arp_moved\";\n rule \"olt_config_write\";\n rule \"bdcom_epon_dying_gasp\";\n rule \"bdcom_epon_onu_config_error\";\n rule \"bdcom_epon_hal_driver_error\";\n rule \"bdcom_epon_onu_info_failed\";\n rule \"bdcom_epon_onu_authenticated\";\n rule \"bdcom_epon_onu_registered\";\n rule \"bdcom_epon_onu_deregistered\";\n rule \"bdcom_epon_oam_status\";\n rule \"bdcom_olt_cli_login\";\n rule \"bdcom_epon_config_saved\";\n rule \"bdcom_epon_interface_link_state\";\n rule \"bdcom_gpon_config_saved\";\n rule \"bdcom_gpon_dying_gasp\";\n rule \"bdcom_gpon_onu_offline\";\n rule \"bdcom_gpon_onu_activate_failed\";\n rule \"bdcom_gpon_onu_disabled\";\n rule \"bdcom_gpon_onu_discovered\";\n rule \"bdcom_gpon_onu_activated\";\n rule \"bdcom_gpon_onu_deactivated\";\n rule \"zte_gpon_dying_gasp\";\n rule \"zte_gpon_onu_signal_degraded\";\n rule \"zte_gpon_onu_lan_los\";\n rule \"zte_epon_dying_gasp\";\n rule \"zte_epon_onu_offline\";\n rule \"zte_gpon_olt_pon_los\";\n rule \"zte_optical_low_power\";\n rule \"zte_power_over_voltage\";\n rule \"zte_alarm_cleared\";\n rule \"zte_cli_login\";\n rule \"zte_cli_logout\";\n rule \"juniper_ddos_violation_set\";\n rule \"juniper_ddos_violation_clear\";\n rule \"juniper_psu_failure\";\n rule \"juniper_memory_parity_error\";\n rule \"juniper_optical_low_power\";\n rule \"juniper_qsfp_eeprom_failed\";\n rule \"juniper_lacp_timeout\";\n rule \"juniper_link_down\";\n rule \"juniper_lag_state_change\";\n rule \"juniper_snmp_auth_violation\";\n rule \"juniper_asic_error\";\n rule \"juniper_bgp_session_reset\";\n rule \"juniper_bgp_addr_not_found\";\n rule \"juniper_ntpd_resource_error\";\n rule \"juniper_ssh_too_many_failures\";\n rule \"juniper_config_commit\";\n rule \"juniper_mgmt_login\";\n rule \"dlink_system_reboot\";\n rule \"dlink_optical_alarm\";\n rule \"dlink_optical_recovered\";\n rule \"dlink_interface_link_state\";\n rule \"dlink_lag_state_change\";\n rule \"dlink_gbic_detected\";\n rule \"dlink_ntp_sync\";\n rule \"dlink_management_ip_changed\";\n rule \"dlink_telnet_login\";\n rule \"dlink_telnet_logout\";\n rule \"dlink_config_saved\";\n rule \"generic_critical_severity\";\nend"
|
|
}
|