Concept Guide

363| esi parser rule Dell Networking W-Series ArubaOS 6.5.x| Reference Guide
Usage Guidelines
The user creates an ESI rule by using characters and special operators to specify a pattern that uniquely
identifies a syslog message. This “condition” defines the type of message and the ESI domain to which this
message pertains. The rule contains three major fields:
l Condition: The pattern that uniquely identifies the syslog message type.
l User: The username identifier. It can be in the form of a name, MAC address, or IP address.
l Action: The action to take when a rule match occurs.
Once a condition match occurs, no further rule-matching will be made. For the matching rule, only one action
can be defined.
For more details on the character-matching operators, repetition operators, and expression anchors used to
defined the search or match target, refer to the External Services Interfacechapter in the Dell Networking W-
Series ArubaOS 6.5.x User Guide .
Use the showesiparserrules command to show ESI parser rule information. Use the
showesiparserstats command to show ESI parser rule statistical information
Examples
The following command sets up the Fortigate virus rule named “forti_rule.” This rule parses the virus detection
syslog scanning for a condition match on the log_id value (log_id=) and a match on the IP address (src=).
(host) (config) #esiparserruleforti_rule
condition“log_id=[0-9]{10}[]”
matchipaddr“src=(.*)[]”
setblacklist
domainfortinet
enable
In this example, the corresponding ESI expression is:
<Sep2618:30:02log_id=0100030101type=virussubtype=infectedsrc=1.2.3.4>
The following example of the test command tests a rule against a specified single syslog message.
testmsg"2618:30:02log_id=0100030101type=virussubtype=infectedsrc=1.2.3.4"
<2618:30:02log_id=0100030101type=virussubtype=infectedsrc=1.2.3.4>
=====
Condition:Matchedwithrule"forti_rule"
User:ipaddr=1.2.3.4
=====
The following example of the test command tests a rule against a file named test.log, which contains several
syslog messages.
testfiletest.log
<Sep2618:30:02log_id=0100030101type=virussubtype=infectedsrc=1.2.3.4>
==========
Condition:Matchedwithrule"forti_rule"
User:ipaddr=1.2.3.4
==========
<Oct1810:43:40cli[627]:PAPI_Send:To:7f000001:8372Type:0x4Timedout.>
==========
Condition:Nomatchingruleconditionfound
==========