Dell W-Series 304 Instant 6.5.1.0-4.3.1.0 CLI Reference Guide - Page 363

Usage Guidelines The user creates an ESI rule by using characters and special operators to specify a pattern that uniquely identifies a syslog message. This "condition" defines the type of message and the ESI domain to which this message pertains. The rule contains three major fields: l Condition: The pattern that uniquely identifies the syslog message type. l User: The username identifier. It can be in the form of a name, MAC address, or IP address. l Action: The action to take when a rule match occurs. Once a condition match occurs, no further rule-matching will be made. For the matching rule, only one action can be defined. For more details on the character-matching operators, repetition operators, and expression anchors used to defined the search or match target, refer to the External Services Interfacechapter in the Dell Networking WSeries ArubaOS 6.5.x User Guide . Use the show esi parser rules command to show ESI parser rule information. Use the show esi parser stats command to show ESI parser rule statistical information Examples The following command sets up the Fortigate virus rule named "forti_rule." This rule parses the virus detection syslog scanning for a condition match on the log_id value (log_id=) and a match on the IP address (src=). (host) (config) #esi parser rule forti_rule condition "log_id=[0-9]{10}[ ]" match ipaddr "src=(.*)[ ]" set blacklist domain fortinet enable In this example, the corresponding ESI expression is: < Sep 26 18:30:02 log_id=0100030101 type=virus subtype=infected src=1.2.3.4 > The following example of the test command tests a rule against a specified single syslog message. test msg "26 18:30:02 log_id=0100030101 type=virus subtype=infected src=1.2.3.4" < 26 18:30:02 log_id=0100030101 type=virus subtype=infected src=1.2.3.4 > ===== Condition: Matched with rule "forti_rule" User: ipaddr = 1.2.3.4 ===== The following example of the test command tests a rule against a file named test.log, which contains several syslog messages. test file test.log < Sep 26 18:30:02 log_id=0100030101 type=virus subtype=infected src=1.2.3.4 > ========== Condition: Matched with rule "forti_rule" User: ipaddr = 1.2.3.4 ========== < Oct 18 10:43:40 cli[627]: PAPI_Send: To: 7f000001:8372 Type:0x4 Timed out. > ========== Condition: No matching rule condition found ========== 363| esi parser rule Dell Networking W-Series ArubaOS 6.5.x | Reference Guide