I have a customer that is saying they are getting garbled output from the parser when using the Cisco FTD connector. Any idea why this output is garbled and how to correct this? See below:
Sample Syslog we are receiving:
message repeated 3 times: [ %FTD-2-106016: Deny IP spoof from (0.0.0.0) to 10.16.96.244 on interface RO_GLOBAL_INT_SEG].
Output they are expecting should look like this:
%FTD-6-430003: EventPriority: High, DeviceUUID: f4787322-9fff-11ed-9ab7-a348479cea01, InstanceID: 4, FirstPacketSecond: 2023-02-13T23:05:46Z, ConnectionID: 55951, AccessControlRuleAction: Block, AccessControlRuleReason: Intrusion Block,SrcIP: 10.0.95.10, DstIP: 2.19.32.89, SrcPort: 62725, DstPort: 80, Protocol: tcp,IngressInterface: corporate, EgressInterface: outside, IngressZone: lan-inside,EgressZone: internet, IngressVRF: Global, EgressVRF: Global,
ACPolicy: NG-Access-Policy, AccessControlRuleName: XYZ-INET
Customer statement:
We are ingesting logs through a normal Syslog for pulling logs. Could you please let me if it supports the new CISCO ASA/ FTD solution-based connector and does it support the CEF format?
This is the garbled output they are getting from the parser:
message repeated 3 times: [ %FTD-2-106016: Deny IP spoof from (0.0.0.0) to 10.16.96.244 on interface RO_GLOBAL_INT_SEG]
This is the type of output they are expecting:
%FTD-6-430003: EventPriority: High, DeviceUUID: f4787322-9fff-11ed-9ab7-a348479cea01, InstanceID: 4, FirstPacketSecond: 2023-02-13T23:05:46Z, ConnectionID: 55951, AccessControlRuleAction: Block, AccessControlRuleReason: Intrusion Block,SrcIP: 10.0.95.10, DstIP: 2.19.32.89, SrcPort: 62725, DstPort: 80, Protocol: tcp,IngressInterface: corporate, EgressInterface: outside, IngressZone: lan-inside,EgressZone: internet, IngressVRF: Global, EgressVRF: Global,
ACPolicy: NG-Access-Policy, AccessControlRuleName: XYZ-INET
D Graves is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.