Collector questions

Question

Hello Everybody!
I would like to ask some questions about creating a collector. I
modified the Apache Agent (utility) to tail -F logfile_path | awk
'{print($0); fflush()}' | $SOCAT_BIN -d -u - $SOCAT_OPTIONS & to send
the logfile to the Sentinel. I will check, but the point is that it
transfer the lines.
The Collector look for a Matching rule and I saw it in the debugger and
also in the Sentinel web interface that I got the event/logfile. I also
see in the debugger that the s_RXBufferString is exists. So I have to
use the safesplit or split methods on this.s_RXBufferString, right? Or
Should I use //.exec()? Or it is totally up to me to use whatever I
want?
If I saw it right, the /()()/.exec() makes/eval the regex and We got
RegExp.$1-$9. If I use the /()()/.test() it will just give me wether the
result of the regex is true or false. Right?
When is it allowed to use field assignment (e.InitiatorUserName =
this.username?
What is the effect when I put the instance.SEND_EVENT into an another
function for example normalize()? Or it is still OK to put elsewhere the
send_event untill it is in one of the preparse(),parse(),normalize()
functions?
Do I have to create a variable like var empty_str or it is enough to do
the this.emptry_str? The preparse(),parse(),normalize() are prototype
javascript function so if I read it well, it is ok to use
this.empty_str. Or will the this.empty_str dissappear after it jumps to
the next function (because of the scope)?
How can I decide when to use RXMapp and when s_RXBufferString? What if I
don't see the s_Body, but have s_RXBufferString? I know that
s_RXBufferString is line-oriented, but is i possible that my syslog/file
data will be in the RXMap?
What if i set the this.dun="testuser"; and in the Rec2Evt.map I add the
UserTargetName,dun pair? It should be always present the TargetUserName
when I look it in the Sentinel web interface, right?
Are there any other source to learn how to create collector?
Thank you for your answers!
woodspeed
woodspeed's Profile: https://forums.netiq.com/member.php?userid=7232
View this thread: https://forums.netiq.com/showthread.php?t=51349

Answer 1

woodspeed;246692 Wrote:
> Hello Everybody!
>
>
> I would like to ask some questions about creating a collector. I
> modified the Apache Agent (utility) to tail -F logfile_path | awk
> '{print($0); fflush()}' | $SOCAT_BIN -d -u - $SOCAT_OPTIONS & to send
> the logfile to the Sentinel. I will check, but the point is that it
> transfer the lines.
> The Collector look for a Matching rule and I saw it in the debugger and
> also in the Sentinel web interface that I got the event/logfile. I also
> see in the debugger that the s_RXBufferString is exists. So I have to
> use the safesplit or split methods on this.s_RXBufferString, right? Or
> Should I use //.exec()? Or it is totally up to me to use whatever I
> want?
> If I saw it right, the /()()/.exec() makes/eval the regex and We got
> RegExp.$1-$9. If I use the /()()/.test() it will just give me wether the
> result of the regex is true or false. Right?
> When is it allowed to use field assignment (e.InitiatorUserName =
> this.username?
> What is the effect when I put the instance.SEND_EVENT into an another
> function for example normalize()? Or it is still OK to put elsewhere the
> send_event untill it is in one of the preparse(),parse(),normalize()
> functions?
> Do I have to create a variable like var empty_str or it is enough to do
> the this.emptry_str? The preparse(),parse(),normalize() are prototype
> javascript function so if I read it well, it is ok to use
> this.empty_str. Or will the this.empty_str dissappear after it jumps to
> the next function (because of the scope)?
> How can I decide when to use RXMapp and when s_RXBufferString? What if I
> don't see the s_Body, but have s_RXBufferString? I know that
> s_RXBufferString is line-oriented, but is i possible that my syslog/file
> data will be in the RXMap?
> What if i set the this.dun="testuser"; and in the Rec2Evt.map I add the
> UserTargetName,dun pair? It should be always present the TargetUserName
> when I look it in the Sentinel web interface, right?
> Are there any other source to learn how to create collector?
>
> Thank you for your answers!
Argh formatting! Let me take this from the top, and hopefully I
won't miss anything:
1) favor exec() over test(). Test is slower, can only handle a very
small number of captures (9), where exec is generally same or better
speed, I haven't hit a limit to the matches, and returns a consistent
indexed array.
2) I personally favor using e.FieldName over using the rec2evt.map,
because especially as a programmer I find it gives better flow control.
That goes against documented guidance a bit, but as long as you're okay
with the possibility of needing to
do a larger find and replace in the event of a schema name change, it's
really not that big of a deal (and if you use notepad++, it's really a
non-issue)
3) instance.SEND_EVENT is a global variable, so you're fine to set
it...anywhere. You can also just call e.send() and return false()
from any of the primary functions (parse(), preparse(), normalize() and
the custom versions of the same), although once again, you risk a
breaking change later, but once again, if you have a good editor, it's
not a big deal.
4) Javascript in general favors use of var over setting properties on
objects, and in my own code I tend to follow that rule. However, if
you need a value to transit between the Record methods, putting it on
the this object isn't a bad idea at all.
5) RXMap is only populated if a value coming in from the connector does
not follow the s_<propname>, i_<propname> nomenclature, or if it's one
of a few special fields that we happen to want at the top of the
metadata. For syslog stuff, you can generally safely not mess with
it.
6) So there are three fields that hold the "message string" for most
connectors:
s_raw_message_2 - the original and completely unfiltered string
s_RXBufferString - for most collectors, same as above, for syslog we
clean it up to be syslog RFC-friendly.
s_body - we strip off the syslog header.
Which field you parse depends on what you need. For an RFC-compliant
syslog stream, s_Body is the most convenient because it has all the
'standard' stuff parsed out and available through other connector
metafields; s_RXBufferString is generally good, but for some exceptional
event sources, our "clean up" actually is a bad thing, which leaves
s_raw_message_2. As a general rule for your use case, I would
recommend s_RXBufferString unless you find that s_Body gives you a clean
value.
7) for your Rec2Evt.map question, well yes - assumign that this.dun was
present and p
8) https://www.novell.com/developer/dev..._sentinel.html is the best
place to start and it's our main resource. If you need more of an A-Z
training, our training services group does offer a training class that
you may want to look into.
brandon.langley
brandon.langley's Profile: https://forums.netiq.com/member.php?userid=350
View this thread: https://forums.netiq.com/showthread.php?t=51349