Request AS400 Device

[shihab123]

What is the sc4s version ?
4.3.1
Is there a pcap available?
Yes
What the vendor name?
AS400
What's the product name?
AS400
** Feature Request description: **
Onboard AS400 Device Data
** Should it support TCP or UDP?**
UDP
** Do you want to have it for local usage or prepare a github PR? **
local usage
AS400_syslog_data.txt

[ikheifets-splunk]

Hello, @shihab123 !

According to your CEF logs your device is "PowerTech Interact". In this log format (CEF) vendor name and product name are embedded in message body.

Are you sure that this logs for AS400? As I understood you mean IBM device. This logs must be identified as PowerTech:Interact

[shihab123]

Hello, Vendor is IBM (ISeries) Product is called Interact Thanks,

…

________________________________ From: Ilya ***@***.***> Sent: Friday, October 13, 2023 5:29 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: shihab123 ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Request AS400 Device (Issue #2238) Hello, @shihab123<https://github.com/shihab123> ! According to your CEF logs your device is "PowerTech Interact". In this log format (CEF) vendor name and product name are embedded in message header. Are you sure that this logs for AS400? As I understood you mean IBM device. — Reply to this email directly, view it on GitHub<#2238 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACAH4PHA5CI55YW4JBVCBDDX7ECYPAVCNFSM6AAAAAA56DMUE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONRRGIYDQMZTG4>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ikheifets-splunk]

@shihab123 if it's okay if we will identify in splunk such device as "PowerTech Interact" ( this vendor information was encoded in logs) ?

[shihab123]

Hello, That should be fine.

…

________________________________ From: Ilya ***@***.***> Sent: Friday, October 13, 2023 10:38 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: shihab123 ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Request AS400 Device (Issue #2238) @shihab123<https://github.com/shihab123> if it's okay if we will identify in splunk such device as "PowerTech Interact", because this vendor information was encoded in logs? — Reply to this email directly, view it on GitHub<#2238 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACAH4PHK7FKHY3UQNLARM7TX7FG43AVCNFSM6AAAAAA56DMUE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONRRGYZTANZTHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ikheifets-splunk]

@shihab123 Cool, thanks!
Can you please also provide .pcap file with that logs?
In your txt files hidden message headers like log date, hostname, etc. I need it because I wanna help you and also it can help me to doublecheck that parser working correctly.

[ikheifets-splunk]

@shihab123 Just give me a PCAP file and I will make PR on 1-2 days.

[ikheifets-splunk]

Hello @shihab123 ! You don't provided me pcap file :( I need to test my Pull Request.

By this reason please test it by yourself using development version of sc4s (docker image) . You just need to update your sc4s on that development version. And tell is it working for you or not. If yes we will merge it.

P.S. Please also tell me what index would be fluent for that logs. Currently it's going to netops

[ikheifets-splunk]

@shihab123 I created pull request for your issue, please test is it work for you, and if yes, I will merge it.
You just need to update your sc4s on that development version of sc4s (docker image) to check your logs format.