Security

host=GMTS instead of hostname when using Cisco Switch with login on-failure log

thaecker
New Member

Hi everybody,

i configured a Cisco switch with "login on-failure log" to log failed authentications to my splunk server. Unfortunately, these events have host=GMTS in splunk instead of the real hostname (host=switchname). Other events from the same switch do not have this problem.

These events look like:

<189>38677: switchname: 038673: Oct 14 12:11:02.419: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: username] [Source: 10.10.10.10] [localport: 22] at 12:11:02 GMTS Thu Oct 14 2010

Is there a way to fix this?

Many thanks in advance.

Tags (2)
0 Karma

williamche
Path Finder

Sounds like the regex statement you're using to extract the host field is the cause... Can you publish your regex, it might help troubleshoot this problem.

Does this happens to every event containing the "GMTS" string towards the end of the line? Can you give an example of events where Splunk correctly extracted the host information?

Here's a regex that might work to extract the correct hostname:

REGEX = \<\d+\>\d+:\s+([^:]+):

Assuming that the hostname is always follow by a colon (":").

0 Karma

thaecker
New Member

I think it is the regex used in Manager >> Fields >> Field transformations >> syslog-host:

:\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s

Seems like only events related to ciscos "login on-failure log" contain the GMTS string, it happens to all of them.

An example event where splunk was able to determine the correct host information is:

<189>39428: 0.0.0.0: 039424: Oct 18 12:29:48.547: %SYS-5-CONFIG_I: Configured from console by username on vty0 (10.10.10.11)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...