Dell 6.2 manual Adding a new parser rule, Deleting a syslog parser rule

In the WebUI

Click on the Syslog Parser Rules tab to display the Syslog Parser Rules view.This view displays a table of rules with the following columns:

•Name— rule name

•Ena—where “y” indicates the rule is enabled and “n” indicates the rule is disabled (not enabled)

•Condition—Match condition (a regular expression)

•Match—Match type (IP address, MAC address, or user)

•User—Match pattern (a regular expression)

•Set—Set type (blacklist or role)

•Value—Set value (role name)

•Domain—Parser domain to which this rule is to be applied

•Actions—The actions that can be performed on each rule.

Adding a new parser rule

To add a new syslog parser rule:

1.Click Add in the Syslog Parser Rules view. The system displays the new rule view.

1.In the Rule Name text box, type the name of the rule you want to add.

2.Click the Enable checkbox to enable the rule.

3.In the Condition Pattern text box, type the regular expression to be used as the condition pattern.

For example, “log_id=[0–9]{10}[ ]” to search for and match a 10-digit string preceded by “log_id=” and followed by one space.

4.In the drop-down Match list, use the drop-down menu to select the match type (ipaddr, mac, or user).

5.In the Match Pattern text box, type the regular expression to be used as the match pattern.

For example, if you selected “mac” as the match type, type the regular expression to be used as the match pattern. You could use “mac[ ](.{17})” to search for and match a 17-character MAC address preceded by the word “mac” plus one space.

6.In the drop-down Set list, select the set type (blacklist or role).

When you select role as the Set type, the system displays a second drop-down list. Click the list to display the possible choices and select the appropriate role value. Validation on the entered value will be based on the Set selection.

7.In the drop-down Parser Group list, select one of the configured parser domain names.

Deleting a syslog parser rule

To delete an existing syslog parser rule:

1.Identify the target parser rule in the list shown in the Syslog Parser Rules view.

2.Click Delete on the same row in the Actions column.

Editing an existing syslog parser rule

To change an existing syslog parser rule:

1.Identify the target parser rule in the list shown in the Syslog Parser Rules view.

2.Click Edit on the same row in the Actions column. The system displays the attributes for the selected rule

NOTE: You cannot modify the rule name when editing a parser rule.

Dell PowerConnect W-Series ArubaOS 6.2 User Guide External Services Interface 758