[Tool] tools/process/syslog/syslog_parser (v. 2006-11-01)

top

the initial version

@MISC{tools-process-syslog-syslog_parser-2006-11-01,
  author = {Tristan Henderson},
  title = {{CRAWDAD} tool tools/process/syslog/syslog_parser (v. 2006-11-01)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/tools/process/syslog/syslog_parser},
  month = nov,  
  year = 2006
}
					

syslog_parser is a script to parse
                the syslog traces from Cisco VxWorks, Cisco IOS and
                Aruba access points. This script was designed to parse
                the syslog traces in the dartmouth/campus/syslog
                tracesets, but should be useful for other traces as
                well.

# cisco_aruba_syslog_parser.pl: a script to parse syslogs 
#
#      Author: Tristan Henderson
#      version: v. 2006-11-01
#      Copyright (c) 2006 Dartmouth College 
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License Version 2 as published by
# the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but WITHOUT 
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
# more details.
#
# You should have received a copy of the GNU General Public License along with
# this program; if not, write to the Free Software Foundation, Inc., 51
# Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

Please send your suggestions, bug reports and fixes to crawdad@cs.dartmouth.edu

cisco_aruba_syslog_parser.pl uses the Time::Local and
                Getopt::Std perl modules.
                If your perl does not include these modules, please
                install a newer version of perl before   
running the cisco_aruba_syslog_parser.pl script.

cisco_aruba_syslog_parser.pl parses syslog traces (see "usage" for the supported syslogs) 
and extracts the following information:

timestamp, client MAC address, message, AP MAC address

See "usage" for details about the parameters needed for each tool.

This is a script to parse the following syslog traces:

- Cisco VxWorks
- Cisco IOS 
- Aruba: note that we don't really know what the Aruba messages mean, but 
		I assume that "station up" means associate and "station down" 
		means disassociate. Since Aruba messages are received from a
        mobility controller, not an AP, they may not correspond
        directly to 802.11 associate/disassociate.

Note that we don't parse all messages, just ones that were interesting to us.

$./cisco_aruba_syslog_parser.pl -h
usage: ./cisco_aruba_syslog_parser.pl [OPTION] [SYSLOG]
-y <year>       define a year for syslogs 
# syslog messages don't contain the year. 
# you can pass the year using -y <year>.
# otherwise we assume the current year
-t              don't reformat time as a Unix timestamp
-r              show the reason for an event (where available)
-b <file>       file containing APs to ignore
-d              output debug info to STDERR
-a <file>       file containing Aruba APs names 
# for internal use
-h              show this help

An example VxWorks syslog record:
Jun 21 05:00:16 AdmBldg25AP1 AdmBldg25AP1 (Info): Station 0006257c081a Associated

An example IOS syslog record:
Jun 21 05:00:09 AcadBldg34AP2 2698: AcadBldg34AP2: Jun 21 09:00:09: %DOT11-6-ASSOC: Interface Dot11Radio0, Station   000d93737dab Reassociated KEY_MGMT[NONE]

An example aruba syslog record:
1125561901 Sep 1 04:05:01 50.110.24.0 2005 [50.110.24.131] authmgr[643]: <INFO> station down <00:02:2d:46:1f:62> bssid 00:0b:86:5c:e5:f9, essid Kiewit Wireless, vlan 2834, ingress 0x10c3 (tunnel 99), u_encr 1, m_encr 1, loc 167.3.2 slotport 0xfc3

$ ./cisco_aruba_syslog_parser.pl 20010411.vxworks.cisco | head
986990216 0040961e58be authenticated AdmBldg19AP3
986990247 0040961e58be authenticated AdmBldg19AP3
986990247 0040961e58be associated AdmBldg19AP3
986990293 0040961e58be authenticated AdmBldg19AP3
986990364 0040961e58be authenticated AdmBldg19AP3
986990484 0040961e58be authenticated AdmBldg19AP3
986991490 0040961e58be authenticated AdmBldg19AP3
986991491 00601db0635a authenticated AdmBldg16AP1
986991491 00601db0635a associated AdmBldg16AP1
986991532 0040961e58be authenticated AdmBldg19AP3

$ ./cisco_aruba_syslog_parser.pl 20040630.IOS.cisco | head
1088568001 0009b7f3ff1f reassociated AcadBldg4AP3
1088568003 00022d12c361 reassociated ResBldg69AP6
1088568003 00022d12c361 roamed ResBldg69AP4
1088568003 00022d12c361 disassociated ResBldg69AP4
1088568006 00022d12c361 authenticated ResBldg69AP4
1088568006 00022d12c361 associated ResBldg69AP4
1088568006 00022d12c361 roamed ResBldg69AP6
1088568008 00904b86f12a disassociated ResBldg44AP4
1088568013 00022dd9b5b2 disassociated SocBldg3AP2
1088568016 0009b7f3ff1f reassociated ResBldg97AP6

$ ./cisco_aruba_syslog_parser.pl 060831.072842.aruba | head
1157009322 001124567039 associated 98.1.2
1157009335 000d93e3e675 associated 167.3.3
1157009342 0016cff28931 associated 68.3.1
1157009344 00131ab19f7c disassociated 188.4.2
1157009344 00131ab19f7c associated 188.3.1
1157009349 001302f5e3e3 disassociated 119.1.1
1157009363 000d28120f0a disassociated 23.3.11
1157009363 000d28120f0a associated 23.3.1
1157020082 0013024da937 associated 119.4.1
1157020093 00131ab19f7c disassociated 188.3.1

[Author] Tristan Henderson

top