文档详情

讲稿user guide用户指南.pdf

发布：2025-03-13约9.92千字共6页下载文档
文本预览下载声明

ParsingScriptUserGuide

Thefollowingparsingscriptshelpyouwriterulesforparsinglogs.Thescriptsidentifycommon

errorsinrules,suchasinvalidXMLordatatypes,andprovidethenumberoflogsthateachrule

hits.Thescriptsrequirethatyouinstallthefollowing:

Python3

Syslog-ng

Manualbashscript(Syslog)

Thisscriptparseslogsusingtheruleswrittenbytheuserandreturnserrors,ifany.

1.First,thescriptvalidateswhethertheXMLstructureofyourrulesfileisvalid(the

structureisthesameasdefinedinthefile‘patterndb.xsd’).Ifitisnotvalid,thescript

returnsanerrorandexits.

2.Thescriptchecksthefieldsintherules.IfanyfieldsdonotmatchtheFireEyeHelix

Taxonomy,thescriptprintsthemontheconsole.Sampleerror:

Foundfielmesthatdidnotmatchwiththetaxonomy.

{detectedtime123,version123}

3.Thescriptchecksforduplicatefieldsineachruleanddisplaysanyduplicatesonthe

console.(Valuesareoverwrittenwhenduplicatefielmesareused.)Sampleerror:

reparsedcorrectlyand

thetotalnumberoflogsthatwerenot.Example:

Logsmatched:1000

Logsunmatched:0

5.Thescriptgeneratesthefollowingfiles:

Anoutputfilethatcontainstheparsedinformation.

Amatchingfilethatcontainsallthelogsthatwereparsedcorrectly.

Anunmatchingfilethatcontainsallthelogsthatwerenotparsedcorrectly.

Atextfilefilenamed‘unidentified_fields.txt’thatcontainsanyfielmesthatdid

notmatchtheFireEyeHelixTaxonomy,

Instructionsforrunning

显示全部
相似文档