Filter
Top Products
In the WebUI
Click on the Syslog Parser Rules tab to display the Syslog Parser Rules view.This view displays a table of rules with
the following columns:
l Name— rule name
l Ena—where “y” indicates the rule is enabled and “n” indicates the rule is disabled (not enabled)
l Condition—Match condition (a regular expression)
l Match—Match type (IP address, MAC address, or user)
l User—Match pattern (a regular expression)
l Set—Set type (blacklist or role)
l Value—Set value (role name)
l Domain—Parser domain to which this rule is to be applied
l Actions—The actions that can be performed on each rule.
Adding a new parser rule
To add a new syslog parser rule:
1. Click Add in the SyslogParser Rules view. The system displays the new rule view.
1. In the Rule Name text box, type the name of the rule you want to add.
2. Click the Enable checkbox to enable the rule.
3. In the Condition Pattern text box, type the regular expression to be used as the condition pattern.
For example, “log_id=[0–9]{10}[]” to search for and match a 10-digit string preceded by “log_id=” and
followed by one space.
4. In the drop-down Match list, use the drop-down menu to select the match type (ipaddr, mac, or user).
5. In the Match Pattern text box, type the regular expression to be used as the match pattern.
For example, if you selected “mac” as the match type, type the regular expression to be used as the match
pattern. You could use “mac[](.{17})” to search for and match a 17-character MAC address preceded by the
word “mac” plus one space.
6. In the drop-down Set list, select the set type (blacklist or role).
When you select role as the Set type, the system displays a second drop-down list. Click the list to display the
possible choices and select the appropriate role value. Validation on the entered value will be based on the Set
selection.
7. In the drop-down Parser Group list, select one of the configured parser domain names.
Deleting a syslog parser rule
To delete an existing syslog parser rule:
1. Identify the target parser rule in the list shown in the SyslogParserRules view.
2. Click Delete on the same row in the Actions column.
Editing an existing syslog parser rule
To change an existing syslog parser rule:
1. Identify the target parser rule in the list shown in the SyslogParserRules view.
2. Click Edit on the same row in the Actions column. The system displays the attributes for the selected rule
NOTE: You cannot modify the rule name when editing a parser rule.
DellPowerConnectW-SeriesArubaOS6.2 | User Guide ExternalServicesInterface | 758