byrsapty
98359c7ca3
Closes the parsing gap the README explicitly called out (no D-Link parsing, no ZTE ONU alarms) plus adds BDCOM GPON and expands Juniper coverage (DDoS, PSU/memory/ASIC hardware faults, LACP/BGP/SNMP, config commit). 58 new rules across 5 vendors, wired into Network Equipment Parsing's stage 0 ahead of the generic_critical_severity fallback. Where the same real-world event is reported by multiple vendors (dying_gasp, onu_offline, optical_low_power, cli_login/cli_logout, config_saved, interface_link_state, lag_state_change), rules share one event_type value so dashboards can aggregate across vendors, same normalization approach as accelppp_interface. Built directly from the user's CSV signature report, not from real device log samples - each rule's description says so explicitly. `when` conditions use plain substring/contains matching on the report's own pattern text to keep classification robust; regex field extraction is only added where the source format is unambiguous. Passed offline checks (JSON validity, every pipeline-referenced rule resolves to a file, all regex patterns compile). Live compilation against a running Graylog instance - which caught 2 real bugs during the dashboard/stream fixes earlier this session - could NOT be completed: the test container went unreachable mid-session. Re-run install-graylog.sh once it's back up to confirm these compile before relying on them.
5 lines
952 B
JSON
5 lines
952 B
JSON
{
|
|
"title": "bdcom_olt_cli_login",
|
|
"description": "BDCOM OLT-style CLI: user logged in (paired with existing olt_privilege_mode/olt_cli_logout rules, which cover the privilege-escalation and logout steps but not the base login) - bdcom.csv row 8. Shared 'cli_login' event_type is reused by other vendors' CLI login rules for cross-vendor dashboards. Built from the provided report, not yet verified against real device output.",
|
|
"source": "rule \"bdcom_olt_cli_login\"\nwhen\n contains(to_string($message.message), \"logged in from\") && contains(to_string($message.message), \"on vty\")\nthen\n set_field(\"vendor\", \"bdcom_olt\");\n set_field(\"event_type\", \"cli_login\");\n let m = regex(\"User (\\\\S+) logged in from (\\\\S+) on vty (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"vty\"]);\n set_field(\"cli_user\", m[\"user\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\n set_field(\"cli_vty\", m[\"vty\"]);\nend"
|
|
}
|