# Copyright (c) 2012 Flowerfire, Inc. All Rights Reserved. aruba_mobility_controller = { plugin_version = "1.1" info.1.manufacturer = "Aruba Networks" info.1.device = "Aruba Mobility Controllers" info.1.version.1 = "620" info.1.version.2 = "ArubaOS 6.1" # 2012-06-11 - 1.0 - Benson - Initial creation from aruba_wireless_switch. # 2012-07-13 - 1.1 - Benson - Modify for compatible with Windows syslog server. # Autodetect a lot of lines, in case the leading ones are KERNEL or other unrecognized lines. log.format.autodetect_lines = 200 # The name of the log format - note: remove number when more versions are supported log.format.format_label = "Aruba 600 Series Mobility Controller Log Format" log.miscellaneous.log_data_type = "syslog_required" log.miscellaneous.log_format_type = "network_device" # The log is in this format if any of the first ten lines match this regular expression #2012-05-22 11:24:51 local1.info 192.168.17.121 authmgr[1521]: <124038> Selected server LDAP_user_192.168.18.93 for method=Web; user=cjtsai, essid=HSR-USER, domain=<>, server-group=LDAP-user-G #2012-07-13 14:01:30 Local7.Info 10.11.6.60 Jul 14 04:01:36 Aruba620 isakmpd[1554]: <103078> IKEv2 CHILD_SA successful for peer 192.168.4.9:4500 log.format.autodetect_regular_expression = '[a-z]+[^:]*: .* <(INFO|ERRS|NOTI|WARN|DBUG)> ' # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Don't remove reloads from sessions, since all "page" values are the same statistics.miscellaneous.remove_reloads_from_sessions = "false" # Log fields log.fields = { daemon = "" pid = "" error_code = "" log_level = "" server_name = "" ap_ip = "" action = "" server = "" method = "" user = "" essid = "" domain = "" group_name = "" message = "" event = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse = ` #authmgr[1521]: <124038> Selected server LDAP_user_192.168.18.93 for method=Web; user=cjtsai, essid=HSR-USER, domain=<>, server-group=LDAP-user-G #sapd[559]: <127004> <192.168.17.121 192.168.17.121> |ids-ap| AP(00:24:6c:49:c5:e0): Interfering AP: An AP detected an interfering access point (BSSID f8:d1:11:a0:ae:d4 and SSID SmartWell Wireless on CHANNEL 6). if (matches_regular_expression(v.syslog_message, '([a-z]+)\\\\[([0-9]+)\\\\]: <([0-9]+)> <([A-Z]+)> <([^ ]+) ([0-9.]+)> [ ]*(.*)')) then ( set_collected_field('', 'daemon', $1); set_collected_field('', 'pid', $2); set_collected_field('', 'error_code', $3); set_collected_field('', 'log_level', $4); set_collected_field('', 'server_name', $5); set_collected_field('', 'ap_ip', $6); v.syslog_message = $7; #Selected server LDAP_user_192.168.18.93 for method=Web; user=cjtsai, essid=HSR-USER, domain=<>, server-group=LDAP-user-G if (matches_regular_expression(v.syslog_message, '([^ ]+) server ([^ ]+) for method=([^;]+); user=([^,]+), essid=([^,]+), domain=<([^>]*)>, server-group=([^ ]+)$')) then ( set_collected_field('', 'action', $1); set_collected_field('', 'server', $2); set_collected_field('', 'method', $3); set_collected_field('', 'user', $4); set_collected_field('', 'essid', $5); set_collected_field('', 'domain', $6); set_collected_field('', 'group_name', $7); ); # selected server else ( set_collected_field('', 'message', v.syslog_message); ); accept_collected_entry('', false); ); ` # Database fields database.fields = { daemon = "" pid = "" error_code = "" log_level = "" server_name = "" ap_ip = "" action = "" server = "" method = "" user = "" essid = "" domain = "" group_name = "" message = "" } # database.fields # Log Filters log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'events = 1;' } # mark_entry set_error_code_404050 = { label = 'Set action for error 404050' comment = 'Addition message for error code 404050' value = 'if (error_code eq "404050") then action = "Packet or Frame Error"' } # set_error_code_404050 set_error_code_403000 = { label = 'Set action for error 403000' comment = 'Addition message for error code 403000' value = 'if (error_code eq "403000") then action = "SSID change detected"' } # set_error_code_403000 set_error_code_202086 = { label = 'Set action for error 202086' comment = 'Addition message for error code 202086' value = 'if (error_code eq "202086") then action = "Netlink ARP Changed"' } # set_error_code_202086 set_error_code_400161 = { label = 'Set action for error 400161' comment = 'Addition message for error code 400161' value = 'if (error_code eq "400161") then action = "Registering AP"' } # set_error_code_400161 set_error_code_208008 = { label = 'Set action for error 208008' comment = 'Addition message for error code 208008' value = 'if (error_code eq "208008") then action = "No change in the Vlan Interface"' } # set_error_code_208008 set_error_code_400175 = { label = 'Set action for error 400175' comment = 'Addition message for error code 400175' value = 'if (error_code eq "400175") then action = "AP Radio Attributes Changed"' } # set_error_code_400175 set_error_code_208007 = { label = 'Set action for error 208007' comment = 'Addition message for error code 208007' value = 'if (error_code eq "208007") then action = "VLAN interface state is currently up or down as indicated"' } # set_error_code_208007 set_error_code_208006 = { label = 'Set action for error 208006' comment = 'Addition message for error code 208006' value = 'if (error_code eq "208006") then action = "VLAN state has changed to up or down as indicated"' } # set_error_code_208006 set_error_code_404074 = { label = 'Set action for error 404074' comment = 'Addition message for error code 404074' value = 'if (error_code eq "404074") then action = "ARM - increasing power"' } # set_error_code_404074 set_error_code_404075 = { label = 'Set action for error 404075' comment = 'Addition message for error code 404075' value = 'if (error_code eq "404075") then action = "ARM - decreasing power"' } # set_error_code_2404075 set_error_code_404097 = { label = 'Set action for error 404097' comment = 'Addition message for error code 404097' value = 'if (error_code eq "404097") then action = "ARM - HT increasing power"' } # set_error_code_404097 set_error_code_404098 = { label = 'Set action for error 404098' comment = 'Addition message for error code 404098' value = 'if (error_code eq "404098") then action = "ARM - HT decreasing power"' } # set_error_code_404098 set_error_code_109005 = { label = 'Set action for error 109005' comment = 'Addition message for error code 109005' value = 'if (error_code eq "109005") then action = "Clear Text Connection will be used with LDAP server"' } # set_error_code_109005 set_error_code_124038 = { label = 'Set action for error 124038' comment = 'Addition message for error code 124038' value = 'if (error_code eq "124038") then action = "A server was selected for user authentication"' } # set_error_code_124038 set_error_code_124003 = { label = 'Set action for error 124003' comment = 'Addition message for error code 124003' value = 'if (error_code eq "124003") then action = "Authentication result"' } # set_error_code_124003 set_error_code_127056 = { label = 'Set action for error 127056' comment = 'Addition message for error code 127056' value = 'if (error_code eq "127056") then action = "Frame Retry Rate Exceeded on Channel"' } # set_error_code_127056 set_error_code_127055 = { label = 'Set action for error 127055' comment = 'Addition message for error code 127055' value = 'if ((error_code eq "127055") or (error_code eq "127022")) then action = "Frame Retry Rate Exceeded"' } # set_error_code_127055 set_error_code_127004 = { label = 'Set action for error 127004' comment = 'Addition message for error code 127004' value = 'if ((error_code eq "127004") or (error_code eq "126005")) then action = "Interfering AP"' } # set_error_code_127004 set_error_code_127057 = { label = 'Set action for error 127057' comment = 'Addition message for error code 127057' value = 'if (error_code eq "127057") then action = "Frame Receive Error Rate Exceeded"' } # set_error_code_127057 set_error_code_127058 = { label = 'Set action for error 127058' comment = 'Addition message for error code 127058' value = 'if (error_code eq "127058") then action = "Frame Receive Error Rate Exceeded on Channel"' } # set_error_code_127058 set_error_code_start_with_1090 = { label = 'Set action for error start with 1090' comment = 'Addition message for error code start with 1090' value = 'if (starts_with(error_code, "1090")) then action = "LDAP Server Message"' } # set_error_code_start_with_1090 } # log.filters database.numerical_fields = { events = { default = true requires_log_field = false entries_field = true } # events } # database.numerical_fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { } # report_groups } # create_profile_wizard_options } # aruba_wireless_switch