graylog-deploy/rules/rule10_accelppp_router_addr_error.json

5 lines
556 B
JSON

{
"title": "accelppp_router_address_error",
"description": "accel-ppp: can't determine router address (PPPoE/IPoE interface error)",
"source": "rule \"accelppp_router_address_error\"\nwhen\n contains(to_string($message.message), \"can't determine router address\")\nthen\n set_field(\"vendor\", \"accel-ppp\");\n set_field(\"event_type\", \"router_address_error\");\n let m = regex(\"error: (\\\\S+): can't determine router address\", to_string($message.message), [\"interface\"]);\n set_field(\"accelppp_interface\", m[\"interface\"]);\nend"
}