-
Notifications
You must be signed in to change notification settings - Fork 8
Open
Labels
Description
Using this configuration in logstash:
tables => [ {"name" => "crasSessionTable" "columns" => [
"1.3.6.1.4.1.9.9.392.1.3.21.1.1", # crasUsername
"1.3.6.1.4.1.9.9.392.1.3.21.1.3", # crasSessionIndex
"1.3.6.1.4.1.9.9.392.1.3.21.1.4", # crasAuthenMethod
"1.3.6.1.4.1.9.9.392.1.3.21.1.6", # crasSessionDuration
"1.3.6.1.4.1.9.9.392.1.3.21.1.8", # crasLocalAddress
"1.3.6.1.4.1.9.9.392.1.3.21.1.10", # crasISPAddress
"1.3.6.1.4.1.9.9.392.1.3.21.1.17", # crasClientVendorString
"1.3.6.1.4.1.9.9.392.1.3.21.1.18", # crasClientVersionString
"1.3.6.1.4.1.9.9.392.1.3.21.1.19", # crasClientOSVendorString
"1.3.6.1.4.1.9.9.392.1.3.21.1.20", # crasClientOSVersionString
"1.3.6.1.4.1.9.9.392.1.3.21.1.31", # crasSessionInPkts
"1.3.6.1.4.1.9.9.392.1.3.21.1.32", # crasSessionOutPkts
"1.3.6.1.4.1.9.9.392.1.3.21.1.33", # crasSessionInDropPkts
"1.3.6.1.4.1.9.9.392.1.3.21.1.34", # crasSessionOutDropPkts
"1.3.6.1.4.1.9.9.392.1.3.21.1.35", # crasSessionInOctets
"1.3.6.1.4.1.9.9.392.1.3.21.1.36", # crasSessionOutOctets
"1.3.6.1.4.1.9.9.392.1.3.21.1.37" # crasSessionState
]}]
Produces this output:
{
"crasSessionState": 0,
"crasClientOSVersionString": "10.0.17763 ",
"crasSessionOutPkts": 62849,
"crasLocalAddress": "",
"crasSessionInPkts": 55160,
"index": "8.x.x.x.x.x.x.x.x.311297",
"crasSessionInOctets": 12843833,
"crasClientVendorString": "AnyConnect",
"crasClientVersionString": "Cisco AnyConnect VPN Agent for Windows 4.8.02045",
"crasClientOSVendorString": "win",
"crasSessionOutDropPkts": 0,
"crasAuthenMethod": 7,
"crasISPAddress": "x.x.x.x",
"crasSessionOutOctets": 42538743,
"crasSessionInDropPkts": 0,
"crasSessionDuration": 5873
},
The columns crasUsername (1.3.6.1.4.1.9.9.392.1.3.21.1.1) and crasSessionIndex (1.3.6.1.4.1.9.9.392.1.3.21.1.3) are absent from the output.
This is using CISCO-REMOTE-ACCESS-MONITOR-MIB
Reactions are currently unavailable