Skip to content

tables option doesn't properly handle columns that comprise the index #42

@johnworkman

Description

@johnworkman

Using this configuration in logstash:

    tables => [ {"name" => "crasSessionTable" "columns" => [
        "1.3.6.1.4.1.9.9.392.1.3.21.1.1", # crasUsername
        "1.3.6.1.4.1.9.9.392.1.3.21.1.3", # crasSessionIndex
        "1.3.6.1.4.1.9.9.392.1.3.21.1.4", # crasAuthenMethod
        "1.3.6.1.4.1.9.9.392.1.3.21.1.6", # crasSessionDuration
        "1.3.6.1.4.1.9.9.392.1.3.21.1.8", # crasLocalAddress
        "1.3.6.1.4.1.9.9.392.1.3.21.1.10", # crasISPAddress
        "1.3.6.1.4.1.9.9.392.1.3.21.1.17", # crasClientVendorString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.18", # crasClientVersionString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.19", # crasClientOSVendorString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.20", # crasClientOSVersionString
        "1.3.6.1.4.1.9.9.392.1.3.21.1.31", # crasSessionInPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.32", # crasSessionOutPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.33", # crasSessionInDropPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.34", # crasSessionOutDropPkts
        "1.3.6.1.4.1.9.9.392.1.3.21.1.35", # crasSessionInOctets
        "1.3.6.1.4.1.9.9.392.1.3.21.1.36", # crasSessionOutOctets
        "1.3.6.1.4.1.9.9.392.1.3.21.1.37" # crasSessionState
    ]}]

Produces this output:

{
  "crasSessionState": 0,
  "crasClientOSVersionString": "10.0.17763 ",
  "crasSessionOutPkts": 62849,
  "crasLocalAddress": "",
  "crasSessionInPkts": 55160,
  "index": "8.x.x.x.x.x.x.x.x.311297",
  "crasSessionInOctets": 12843833,
  "crasClientVendorString": "AnyConnect",
  "crasClientVersionString": "Cisco AnyConnect VPN Agent for Windows 4.8.02045",
  "crasClientOSVendorString": "win",
  "crasSessionOutDropPkts": 0,
  "crasAuthenMethod": 7,
  "crasISPAddress": "x.x.x.x",
  "crasSessionOutOctets": 42538743,
  "crasSessionInDropPkts": 0,
  "crasSessionDuration": 5873
},

The columns crasUsername (1.3.6.1.4.1.9.9.392.1.3.21.1.1) and crasSessionIndex (1.3.6.1.4.1.9.9.392.1.3.21.1.3) are absent from the output.

This is using CISCO-REMOTE-ACCESS-MONITOR-MIB

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions