8 new rules (vendor=a10) wired into Network Equipment Parsing: LSN
TCP/Session/ICMP per-user quota exceeded (critical - real service
impact, drops new connections for that subscriber), BGP-4-MAXPFX
prefix-limit warning, and admin session open/close/timeout/auth-success
(aXAPI and CLI both covered by one pattern each).
Unlike the CSV-report-derived rules, these are built directly from
real captured A10 log output the user provided, so confidence is
higher - closer to the accel-ppp rules' provenance. Multi-entry LSN
lines (several 'ip(count)' pairs in one quota-exceeded message) only
have their first pair extracted into fields; the full list stays in
the raw message.
Not live-verified - the user is bringing the target system up
themselves this time rather than through the test container used
earlier in this branch of work.
byrsapty
b0e4095cae