What to do in case of a malfunctioning / non-existing parse
What to do in case of a malfunctioning / non-existing parse
The logging method and the format of the logs are different for each
device. What's more, the format of the logs can also start to vary by
simply changing the device's firmware.
If the device logs you want to track are not normalized (parsed)
correctly after being stored in the Logmanager database or are not
normalized at all, we are speaking about non-functional or non-existent
parser.
Non-functional parser rule
In case of suspicion that the parser which processes certain logs is not
working properly, you need to ask Logmanager's vendor to repair or add
functionality.
In order to minimize the correction time of parsing rule, please follow
these steps:
Export the original logs (only raw field).
Provide information about the device/software (Device type, vendor,
version, running firmware version).
If available provide device documentation that describes how this
device writes logs and in what format they are being sent.
Sumarize your idea of how the normalized log should look after the
parser to give you all necessary information at first glance.
Send all of this information to partner/vendor.
Steps to make export of original logs
In the Logmanager console, in the Logs/Dashboards menu, select the “Log overview” dashboard.
Log overview
In the “PARSER NAME” panel, click the circle next to the broken parser. This creates a filter that selects only the logs used by this parser.
“PARSER NAME” panel
If a particular parser is not visible here, you need to change the selection filter.
In the "ALL EVENTS" panel, in the field "Fields" - uncheck all the fields.
“ALL EVENTS” panel
and check only the “raw” field.
raw field
This completes the selection of logs and fields that need to be sent to the vendor.
The final step is export itself, which can be started with the “Export” button.
export
Please make sure, that you don`t export a large number of logs. It would slow down the export time.
Changing the selection filter
Points 1. and 2. are only performed if particular parser is not visible:
Select any parser on the "PARSER NAME" panel by clicking the circle next to it. Click on the filter you created - directly to “must” in “terms” box.
created filter
Modify the filter by typing the name of the desired parser into the “value” field. The parser name can be found in the Parser/Parsers menu.
Modify filter
In order to save this filter, click on the Apply button.
No need to worry if the logs coming from device for which Logmanager
does not have a built-in parser, the customer will not lose any logs.
Logs are stored in the database in all cases - in this case just without
normalization, in the original format.
To ensure that logs from the device are normalized and stored in an
uniform format, please follow the steps below:
Export the original logs (only raw field).
Provide information about the device/software (Device type, vendor, version, running firmware version).
If available provide device documentation that describes how this device writes logs and in what format they are being sent.
Sumarize your idea of how the normalized log should look after the parser to give you all necessary information at first glance.
Send all of this information to partner/vendor.
Steps to make export of original logs
In the Logmanager console, in the Logs/Dashboards menu, select the “Log overview” dashboard.
“Log overview”
In the “PARSER NAME” panel, click the circle next to the “unknown” parser. This creates a filter that selects only logs which did not pass through any parser rule.
“PARSER NAME” panel
Make one more filter (based on the IP address in the “DEVICE IP” panel) which will specify logs from a specific device that require a new parser.
“PARSER NAME” panel
In the "ALL EVENTS" panel, in the field "Fields" - uncheck all the fields.
“ALL EVENTS” panel
and check only the “raw” field.
raw field
This completes the selection of logs and fields that need to be sent to
the vendor.
The final step is export itself, which can be started with the “Export” button.
export
Please make sure, that you don`t export a large number of logs. It
would slow down the export time.