Skip to main content
Version: 10.1

rWeb Syslog Messages

When configured with a syslog server, rWeb will send syslog messages. There are three main categories of messages: alert messages, license messages, and attack messages.

Message Formats​

Standard rWeb messages will conform to RFC 5424:

Standard Syslog Message

1 2018-01-31T20:49:47.196377+00:00 rweb7 27180  - -  syslog_logger:180      INFO     Attack stopped. Group: G11_1, Zone: Z11.1.2, Zone ID: 2506, Victim IP: 2000:bb:64a8:9b00::b01:202, Victim ID: 12833135, AT: 9, ST: 3, Type: AT9 MISUSED APPLICATION

Redundant rWeb messages do not conform, as they will be missing a correct timestamp and additional source information. You may need to configure additional parsers or extractors to properly search these messages:

Redundant rWeb Syslog Message

20910 syslog_logger:155      INFO     Attack detected. Group: Default, Zone: Default, Zone ID: 0, Victim IP: 13.2.1.36, Victim ID: 3378685, AT: 9, ST: 3, Type: AT9 MISUSED APPLICATION

For parsing purposes, messages that have group or zone names will escape ',' and '\' characters in those names with a backslash ('\'):

Escaped Characters in Group and Zone Names

1 2018-01-29T18:31:55.951285+00:00 rweb7 23902  - -  syslog_logger:166      INFO     Attack detected. Group: G14_1, Zone: Z\,1\\4.1.2, Zone ID: 2480, Victim IP: 2000:bb:64a8:9b00::e01:202, Victim ID: 12829401, AT: 9, ST: 3, Type: AT9 MISUSED APPLICATION

Alert Messages​

Any configured alerts that are enabled for syslog will generate a syslog message:

Example Alert Message

1 2018-01-30T22:02:33.072450+00:00 rweb7 12332  - -  syslog_logger:425      WARNING  IPv4 prefix on device re18-1 exceeded the limit

Licenses Messages​

rWeb will generate messages for devices with a change in license status:

License Syslog Messages

1 2018-01-28T00:00:14.290584+00:00 rweb7 18478  - -  syslog_logger:425      WARNING  License on device rx10-1 is expiring now
1 2018-01-31T19:42:38.334079+00:00 rweb7 27197  - -  syslog_logger:425      ERROR    License on device rx10-1 has expired

Attack Messages​

rWeb will generate syslog messages for the start and end of attacks. Contrary to RIOS syslog attack messages, rWeb generates messages based on input from each filter device and the level of attack traffic which generates them are configurable.

Attack syslog messages are generated based on the same rules for victim email notifications. If an email attack notification would be generated, so will a syslog message. When an attack has stopped, a corresponding end of attack message will be generated.

Attack Start and Stop Messages

1 2018-01-31T12:54:09.041764+00:00 rweb7 27187  - -  syslog_logger:166      INFO     Attack detected. Group: G14_3, Zone: Z14.3.1, Zone ID: 2485, Victim IP: 14.3.1.7, Victim ID: 12831837, AT: 8, ST: 3, Type: AT8 SESSION ATTACK
1 2018-01-31T13:28:45.591820+00:00 rweb7 27180  - -  syslog_logger:180      INFO     Attack stopped. Group: G14_3, Zone: Z14.3.1, Zone ID: 2485, Victim IP: 14.3.1.7, Victim ID: 12831837, AT: 8, ST: 3, Type: AT8 SESSION ATTACK 

In the message portion of the syslog, details about the attack can be parsed from "KEY: VALUE," entries in the message. The following information is included:

  • Group- The group name containing the destination zone
  • Zone- The zone name containing the victim under attack
  • Zone ID- The zone ID used in the API
  • Victim IP- The IPv4 or IPv6 address of the victim
  • Victim ID- The victim ID used in the API
  • AT- The numeric representation of the attack type used on the victim
  • ST- A space-separated list of subtype numbers for the attack type used on the victim
  • Type- The text description of the attack type used on the victim