NXLog User Guide

47. Cisco ACS

An example Syslog record from a Cisco Secure Access Control System (ACS) device looks like the following. For more information, refer to the Syslog Logging Configuration Scenario chapter in the Cisco Configuration Guide.

Log Sample

<38>Oct 16 21:01:29 10.0.1.1 CisACS_02_FailedAuth 1k1fg93nk 1 0 Message-Type=Authen failed,User-Name=John,NAS-IP-Address=10.0.1.2,AAA Server=acs01

Example 207. Collecting From Cisco Secure ACS

The following configuration file instructs NXLog to accept Syslog messages on UDP port 1514. The payload is parsed as Syslog and then the ACS specific fields are extracted. The output is written to file in JSON format.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

  <Extension _json>
    Module  xm_json
</Extension>

<Extension _syslog>
    Module  xm_syslog
</Extension>

<Input in>
    Module  im_udp
    Host    0.0.0.0
    Port    1514
    <Exec>
      parse_syslog_bsd();
      if ( $Message =~ /^CisACS_(\d\d)_(\S+) (\S+) (\d+) (\d+) (.*)$/ )
      {
        $ACSCategoryNumber = $1;
        $ACSCategoryName = $2;
        $ACSMessageId = $3;
        $ACSTotalSegments = $4;
        $ACSSegmentNumber = $5;
        $ACSMessage = $6;
        if ( $ACSMessage =~ /Message-Type=([^\,]+)/ ) $ACSMessageType = $1;
        if ( $ACSMessage =~ /User-Name=([^\,]+)/ ) $AccountName = $1;
        if ( $ACSMessage =~ /NAS-IP-Address=([^\,]+)/ ) $ACSNASIPAddress = $1;
        if ( $ACSMessage =~ /AAA Server=([^\,]+)/ ) $ACSAAAServer = $1;
      }
      else log_warning("Does not match: " + $raw_event);
    </Exec>
</Input>

<Output out>
    Module  om_file
    File    "tmp/output.txt"
    Exec    to_json();
</Output>