vbscript to parse information

I am a real newbie....
would you be willing to elaborate and explain?

OK for the most part it works, but unfortunately the messages are not identical...
one type is :
%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 124.13.90.231, src_addr= 22.26.136.15, prot= tcp
the other is:
%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group

Is there a way to do an if then to look at both?
Do I need to declare all of the items below in the Dim's?
When I parse the first message for the src_addr with an end of , prot= as dstEnd = InStr(1, s1, "\, prot=")
if fails....is a comma not allowed?


Dim M
Dim s1
Dim s2
Dim dstStart
Dim dstEnd
Dim srcout

' Copy message to local variable for speed
M = Fields.VarCleanMessageText

' If message length is too short, exit function
If Len(M) < 15 then exit function
M = ""
dstStart = ""
dstEnd = ""
s1 = ""
srcout = ""
Fields.VarCustom01 = ""
s1 = M
'    dstStart = InStr(1, s1, "outside:") + Len("outside:")
'    dstEnd = InStr(1, s1, "/")
'    srcout = Mid(s1, dstStart, dstEnd - dstStart)

   dstStart = InStr(1, s1, "src_addr=") + Len("src_addr=")
    dstEnd = InStr(1, s1, "\, prot=")
    srcout = Mid(s1, dstStart, dstEnd - dstStart)



Fields.VarCustom01 = srcout

Hi brian_appliedcpu

VbScript has access to the parsing object, RegExp. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/script56/html/vtoriVBScript.asp

The following code extracts two src outside codes that match the ppatern of "src outside" 3 digits dot 2 digits dot two diguts dot. 3 digits.

123.13.12.123
143.13.12.123 (i made this up for testing)

If you provide an example of your dst_addr I will pass that too.


Sub GetT()
    Dim RegX, RegI, M, s
    Dim C As String
    C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group ""outside_access_in""" & _
        ":%PIX-4-402106: src outside:143.13.12.123 Rec'd packet not an IPSEC packet. (ip) dest_addr= 12.45.90.231, src_addr= 11.2.136.15, prot= tcp"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Global = True
    RegX.MultiLine = True
    RegX.Pattern = "src\s{1}outside:(\d{3}\.\d{2}.\d{2}\.\d{3})"
    Set RegI = RegX.Execute(C)
    For Each M In RegI
        Set subm = M.submatches
        For Each s In subm
            Debug.Print s
        Next
    Next
End Sub

Unfortunately the addresses can be 1 to 3 digits in each filed (octet).
24.24.90.123
11.2.136.15
123.198.1.1

no problem

change
RegX.Pattern = "src\s{1}outside:(\d{3}\.\d{2}.\d{2}\.\d{3})"
to
RegX.Pattern  ="src\s{1}outside:(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"

Cheers

Dave

in your code, change
dstEnd = InStr(1, s1, "/")
to
dstEnd = InStr(dstStart, s1, "/")

I will actually be only evaluating one string but the string changes, sometimes it looks like:
%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 124.13.90.231, src_addr= 22.26.136.15, prot= tcp
and somtimes it looks like:
%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group

In your script listed below are you looking for multiple matches?  I will only be passing one of the above stings to the script as a variable M = Fields.VarCleanMessageText and wanting to stip out the src_addr= or src outsdide: depending on how it is passed to the script.

Sub GetT()
    Dim RegX, RegI, M, s
    Dim C As String
    C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group ""outside_access_in""" & _
        ":%PIX-4-402106: src outside:143.13.12.123 Rec'd packet not an IPSEC packet. (ip) dest_addr= 12.45.90.231, src_addr= 11.2.136.15, prot= tcp"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Global = True
    RegX.MultiLine = True
    RegX.Pattern = "src\s{1}outside:(\d{3}\.\d{2}.\d{2}\.\d{3})"
    Set RegI = RegX.Execute(C)
    For Each M In RegI
        Set subm = M.submatches
        For Each s In subm
            Debug.Print s
        Next
    Next
End Sub

The code below does pick up any match for either src_addr= or src outside. In the case below it picks up both as I've put both examples in the string

If there is only one occurence in a string it will pick up only that one

Sub GetT()
    Dim RegX, RegI, M, s
    Dim C As String
    C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group ""outside_access_in""" & _
        ":%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 12.45.90.231, src_addr= 11.2.136.15, prot= tcp"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Global = True
    RegX.MultiLine = True
    RegX.Pattern = "(?:src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    For Each M In RegI
        Set subm = M.submatches
        For Each s In subm
            Debug.Print s
        Next
    Next
End Sub

Cheers

Dave

OK what am I missing?
what is the variable name that is supposed to be parsed out?

the submatchs contains your info, in the case above it is returned by s

I've altered the code below so that is only finds the first match, either  "src outside: number" or "src_addr= number " and then puts it either to VarCustom01 ot VarCustom02

Sub GetT()
    Dim RegX, RegI, VarCustom01, VarCustom02
    Dim C As String
    C = ":%P1.2.136.15, prot= tcp"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        VarCustom01 = subm(1)
        MsgBox "VarCustom01 is " & VarCustom01
    Else
        VarCustom02 = subm(1)
        MsgBox "VarCustom02 is " & VarCustom02
    End If
End Sub

aplogies, wrong test string above

Sub GetT()
    Dim RegX, RegI, VarCustom01, VarCustom02
    Dim C As String
  C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group ""outside_access_in""" & _
        ":%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 12.45.90.231, src_addr= 11.2.136.15, prot= tcp"

    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        VarCustom01 = subm(1)
        MsgBox "VarCustom01 is " & VarCustom01
    Else
        VarCustom02 = subm(1)
        MsgBox "VarCustom02 is " & VarCustom02
    End If
End Sub

I have adjusted this to remove the sub as I don't think I need the sub since it is the entire script, I also changed the exit to exit function.  
I moved the Dims up to the top of the script
I also removed the "as String" as I am actually passing the message to the script as M.
I removed the  MsgBox "VarCustomXX as there is no way for me to see the box..
I tested my previous main script with the one that mmcain had offered so i know that i am actually passing info, but something is just not right here.  

Can you please look at it and see where I screwed up?


Function Main()
Dim M
Dim RegX
Dim RegI
Dim C

M = Fields.VarCleanMessageText
C = M


' If message length is too short, exit function
If Len(M) < 15 then exit function


' Sub GetT()

    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit function
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        Fields.VarCustom01 = subm(1)
'        MsgBox "VarCustom01 is " & VarCustom01
    Else
        Fields.VarCustom02 = subm(1)
'        MsgBox "VarCustom02 is " & VarCustom02
    End If
' End Sub

Fields.VarCustom03 = Fields.VarCleanMessageText
End function

Hi Brian,

I actually tested this in Excel.

What string is being passed to C?
Is anything being extracted by subm(1) or subm(2)?

Cheers

Dave

The below:

:%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in

How do you test this in excel?

this code gave me "123.13.12.123"

start Excel

- hold down Alt & F11 to go to the Visual basic Editor (VBE)
- Insert Module
- paste the code below
- hit F5 to Run (or Run via menu). Alternatively you can step through the code using F8.

Sub GetT()
Dim RegX, RegI, VarCustom01, VarCustom02
Dim C          As String
    C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        VarCustom01 = subm(1)
        MsgBox "VarCustom01 is " & VarCustom01
    Else
        VarCustom02 = subm(1)
        MsgBox "VarCustom02 is " & VarCustom02
    End If
End Sub

Your right it works fine in excel...but not in my app...
I am running it in Kiwi Syslog server as an Action.
It supports the VBScripting Language
Currently two scripting languages are supported:

VBScript - A variation of Visual Basic or VBA (Visual Basic for Applications) used in MS Word and Excel. This language is easy to learn and has a rich feature set.

JScript - A variation of Java Script used in web pages. If you are familiar with Java Script then this may be your language of choice.

It does not seem to like the sub though.
it wants it all between...

Example:
***************************************
Function Main()

' Your code goes here


' Set the return value to OK

Main = "OK"
End Function
*****************************************
So my code looks like this...

Function Main()

' By default, skip to the next rule, don't take the actions that follow
' If we exit the function before we get to the end, the default 'skip to next rule'
' will be used.
Fields.ActionQuit = 100

' This script will parse a Cisco Firewall syslog file and pass the source IP and hostname
' to custom variables. These values can then be passed to other actions.

'
' Ensure that the Fields read/write permissions are set as below...
'
'                Read | Write
' Common fields    X  |
' Other fields        |
' Custom fields       |  X
'
'


' We want to find the source IP address and pass it to custom variables



'Sub GetT()
Dim RegX, RegI, VarCustom01, VarCustom02, C
'Dim C
'    C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in"
 C = Fields.VarCleanMessageText  
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then End Function
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        Fields.VarCustom01 = subm(1)
'        MsgBox "VarCustom01 is " & VarCustom01
    Else
        Fields.VarCustom02 = subm(1)
'        MsgBox "VarCustom02 is " & VarCustom02
    End If
'End Sub





' Since we have a valid match, we want to execute the send e-mail action which follows.
' Setting ActionQuit to 0 means we won't skip any actions.
Fields.ActionQuit = 0
 
End function

 
' Set the return value to OK
Main = "OK"
End Function

Ok....
I seem to have the sub/main issue semi out of the way...but it appears that my sub is not returning the values...can you take a look at this?


Sub GetT(M)
Dim RegX, RegI, src_addr01, src_addr02
Dim C
C = M
' Dim C As String
 '   C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in"
    Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(src\s{1}outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "src outside:" Then
        src_addr01 = subm(1)
'        MsgBox "VarCustom01 is " & src_addr01
    Else
        src_addr02 = subm(1)
'       MsgBox "VarCustom02 is " & src_addr02
    End If

End Sub


Function Main()


' By default, skip to the next rule, don't take the actions that follow
' If we exit the function before we get to the end, the default 'skip to next rule'
' will be used.
'Fields.ActionQuit = 100

' This script will parse a Cisco Firewall syslog file and pass the source IP and hostname
' to custom variables. These values can then be passed to other actions.

'
' Ensure that the Fields read/write permissions are set as below...
'
'                Read | Write
' Common fields    X  |
' Other fields        |
' Custom fields       |  X
'
'
' Dim M
' M = Fields.VarCleanMessageText
 Dim M As String
    M = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in"


' We want to find the source IP address and pass it to custom variables

 GetT (M)

'Fields.VarCustom01 = src_addr01
'Fields.VarCustom02 = src_addr02
'Fields.VarCustom03 = C
MsgBox "VarCustom01 is " & src_addr01
MsgBox "VarCustom02 is " & src_addr02
MsgBox "VarCustom03 is " & C

' Since we have a valid match, we want to execute the send e-mail action which follows.
' Setting ActionQuit to 0 means we won't skip any actions.
'Fields.ActionQuit = 0
 


 
' Set the return value to OK
Main = "OK"
End Function

OK I know you havn't responded...but I kept plugging away at it and I am ready to accept an answer.

mccainz2 was the first to answer and although i ended up not using his script he was very helpful in explaining the parsing process so I would like to give him 100 points.

brettdj you were awesome so you would get the other 400.

If anyone objects or would like to comment please do.

I will close this out within 12 hours if I do not hear from anyone.

Thank you all

Hi Brian,

Sorry, my timezone often doen't align well with the rest of EE.

Is your sub still not parsing the data correctly? I've answered a number of parsing questions in VB and I've always tested them using the VBScript RegExp object in Excel VBA - I'm not sure why this one isn 't working

Maybe its worth posting another link to this question to see if there is someone who knows why the Kiwi Syslog server doesn't like it?

Cheers

Dave

No....and yes

For the most part it is but it appears to return the value if the pattern contains outside: but not src_addr.  I replaced the line  If subm(0) = "outside:" Then with  If subm(0) = "src_addr=" Then   and it works fine for those with src_addr but not outside:

Sub GetT(M, A, B, C)
Dim RegX, RegI, src_addr01, src_addr02
'Dim C
'C = M
'Dim C As String
  '  C = ":%PIX-4-106023: Deny tcp src outside:123.13.12.123/80 dst inside:24.24.90.123/5694 by access-group outside_access_in"
Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "outside:" Then
        VCustom01 = subm(1)
        MsgBox "VarCustom01 is " & VCustom01
        A = VarCustom01
        MsgBox "AVarCustom01 is " & A
    Else
        VCustom02 = subm(1)
        MsgBox "VarCustom02 is " & VCustom02
        B = VarCustom02
        MsgBox "BVarCustom02 is " & B
    End If

End Sub

Can you please post the test string with the non src_addr match, I can think of a couple of possible reasons.

(1) Are you getting matches for both src_addr and outside in the same string?

If yes then the code needs changing as it currently only finds the first match

(2)
in an earlier example for src_addr there was a space before the number, ie
src_addr= 11.2.136.15

And the pattern is looking for this space
RegX.Pattern = "(outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"

Does your string have this space ? (Presumably yes if your code change worked)

Cheers

Dave

Possible string #1

:%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 24.123.90.231, src_addr= 65.6.123.15, prot= tcp


Possible string #2

:%PIX-4-106023: Deny tcp src outside:216.136.173.205/80 dst inside:24.123.90.231/49502 by access-group "outside_access_in"

The script receives only one string and i need to match only one item either the src_addr= or the outside:

Thanks for your diligence in solving this.

bkl

I had screwed up in the declarations and when i renamed the value from B = VCustom02 i had B = VarCustom02 which had a value of "" so it was sending an empty string....
Are you ok with the points split?
Give my other open question a shot if you like, the link is listed at the bottom of this.


Sub GetT(M, A, B, C)
Dim RegX, RegI, VarCustom01, VarCustom02, VCustom01, VCustom02
Set RegX = CreateObject("vbscript.regexp")
    RegX.Pattern = "(outside:|src_addr= )(\d{1,3}\.\d{1,3}.\d{1,3}\.\d{1,3})"
    Set RegI = RegX.Execute(C)
    If RegI.Count = 0 Then Exit Sub
    'no matches
    Set subm = RegI(0).submatches
    If subm(0) = "outside:" Then
        VCustom01 = subm(1)
        MsgBox "VarCustom01 is " & VCustom01
        A = VCustom01
        MsgBox "AVarCustom01 is " & A
    Else
        VCustom02 = subm(1)
        MsgBox "VarCustom02 is " & VCustom02
        B = VCustom02
        MsgBox "BVarCustom02 is " & B
    End If

End Sub




http://www.experts-exchange.com/Programming/Q_21000625.html#11148344
 
   

The points split is fine with me Brian

I'll wander off and have a look at your other question

Cheers

Dave

Sorry about the accepted vs the assisted, must have screwed up somewhere....
Is there someplace that I can fix it?

bkl