byrsapty
b0e4095cae
8 new rules (vendor=a10) wired into Network Equipment Parsing: LSN TCP/Session/ICMP per-user quota exceeded (critical - real service impact, drops new connections for that subscriber), BGP-4-MAXPFX prefix-limit warning, and admin session open/close/timeout/auth-success (aXAPI and CLI both covered by one pattern each). Unlike the CSV-report-derived rules, these are built directly from real captured A10 log output the user provided, so confidence is higher - closer to the accel-ppp rules' provenance. Multi-entry LSN lines (several 'ip(count)' pairs in one quota-exceeded message) only have their first pair extracted into fields; the full list stays in the raw message. Not live-verified - the user is bringing the target system up themselves this time rather than through the test container used earlier in this branch of work.
5 lines
823 B
JSON
5 lines
823 B
JSON
{
|
|
"title": "a10_bgp_maxpfx_warning",
|
|
"description": "A10 Router process: BGP peer approaching its configured max-prefix limit (IPv4 Unicast) - early warning before the session would be reset for exceeding it. Built from real captured A10 syslog output.",
|
|
"source": "rule \"a10_bgp_maxpfx_warning\"\nwhen\n contains(to_string($message.message), \"BGP-4-MAXPFX\")\nthen\n set_field(\"vendor\", \"a10\");\n set_field(\"event_type\", \"bgp_maxpfx_warning\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"from (\\\\S+) \\\\(IPv4 Unicast\\\\): reaches (\\\\d+), max (\\\\d+)\", to_string($message.message), [\"peer\",\"count\",\"max\"]);\n set_field(\"bgp_peer\", m[\"peer\"]);\n set_field(\"bgp_prefix_count\", to_long(m[\"count\"]));\n set_field(\"bgp_prefix_max\", to_long(m[\"max\"]));\nend"
|
|
}
|