From e1f7203090cbfc1005e07462f5e61a8f85f325ea Mon Sep 17 00:00:00 2001 From: Quan Nguyen Date: Mon, 23 Dec 2024 14:02:56 -0500 Subject: [PATCH] Added 3 new events types - sFlow events (10xx) - Self Test events (450x) - REST events (46xx) Note: this is based upon the OS 10.15 message types which are different than 10.07. Will allow the rest of the already mapped fields in another PR --- .../hpe_aruba_cx/_dev/build/docs/README.md | 129 +- .../pipeline/test-aruba-cx.log-expected.json | 157 +- .../test/pipeline/test-aruba-fabricated.log | 83 + .../test-aruba-fabricated.log-expected.json | 9520 +++++++++++------ .../elasticsearch/ingest_pipeline/default.yml | 291 + .../data_stream/log/fields/fields.yml | 96 + packages/hpe_aruba_cx/docs/README.md | 158 +- 7 files changed, 7082 insertions(+), 3352 deletions(-) diff --git a/packages/hpe_aruba_cx/_dev/build/docs/README.md b/packages/hpe_aruba_cx/_dev/build/docs/README.md index 0582a7861b7..7b2e2a6b51e 100644 --- a/packages/hpe_aruba_cx/_dev/build/docs/README.md +++ b/packages/hpe_aruba_cx/_dev/build/docs/README.md @@ -992,67 +992,78 @@ Note: Descriptions have not been filled out |------------|------------------------------| | | aruba.instance.id | -#### [REST events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/RESTD.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.rest.action | | | event.action | -| aruba.rest.activate_address | | | server.address | -| aruba.rest.added_user | | | | -| aruba.rest.added_user_role | | | aruba.role | -| aruba.rest.agent_name | | | agent.name | -| aruba.rest.autztype | | | | -| aruba.rest.central_location | | | server.address | -| aruba.rest.reboot_command | | | | -| aruba.rest.config_from_name | | | | -| aruba.rest.config_to_name | | | | -| aruba.rest.deleted_user | | | | -| aruba.rest.dns | | | | -| aruba.rest.dns_nameserver | | | dns.id | -| aruba.rest.error | | | error.message | -| aruba.rest.match | | | | -| aruba.rest.mode | | | | -| aruba.rest.resource | | | | -| aruba.rest.rest_operation | | | | -| aruba.rest.script_name | | | | -| aruba.rest.sessionid | | | | -| aruba.rest.source_ip | | | source.ip | -| aruba.rest.subscriber | | | | -| aruba.rest.subscription | | | | -| aruba.rest.config_value | | | | -| aruba.rest.uri | | | url.full | -| aruba.rest.url | | | url.full | -| aruba.rest.user | | | user.name | -| aruba.rest.vrf | | | aruba.vrf.id | - -#### [Self Test events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SELFTEST.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.self_test.error | | | error.message | -| aruba.self_test.interface | | | | -| aruba.self_test.slot | | | aruba.slot | -| aruba.self_test.stack | | | | -| aruba.self_test.subsystem | | | aruba.subsystem | +#### [REST events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/RESTD.htm) +| Docs Field | Schema Mapping | +|----------------------|----------------------------| +| `` | event.action | +| `` | aruba.rest.activate_address| +| `` | aruba.rest.added_user | +| `` | aruba.role | +| `` | aruba.rest.autztype | +| `` | aruba.rest.central_location| +| `` | aruba.rest.central_source | +| `` | aruba.rest.command | +| `` | aruba.rest.config_name | +| `` | aruba.rest.deleted_user | +| `` | aruba.rest.ip | +| `` | aruba.rest.dns_nameserver | +| `` | event.reason | +| `` | aruba.rest.config_from_name| +| `` | aruba.rest.identity | +| `` | client.ip | +| `` | aruba.rest.match | +| `` | aruba.interface.id | +| `` | aruba.rest.mode | +| `` | aruba.rest.name | +| `` | aruba.rest.resource | +| `` | aruba.rest.operation | +| `` | aruba.session.id | +| `` | source.ip | +| `` | aruba.rest.subscriber | +| `` | aruba.rest.subscription | +| `` | aruba.rest.config_to_name | +| `` | url.original | +| `` | url.original | +| `` | user.name | +| `` | aruba.vrf.id | +| `` | aruba.vrf.name | +| `` | aruba.rest.type | + +#### [Self Test events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SELFTEST.htm) +| Docs Field | Schema Mapping | +|--------------|-----------------------------| +| ``| aruba.interface.id | +| `` | aruba.slot | +| `` | aruba.self_test.stack | +| ``| aruba.subsystem | +| `` | event.reason | + +#### [Self Test Monitor events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SelfTestMonitor.htm) +| Docs Field | Schema Mapping | +|--------------|-----------------------------| #### [sFlow events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SFLOW.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.sflow.bridge | | | | -| aruba.sflow.chain | | | | -| aruba.sflow.desc | | | | -| aruba.sflow.dgramsize | | | | -| aruba.sflow.error | | | error.message | -| aruba.sflow.file | | | file.name | -| aruba.sflow.hdrlen | | | aruba.len | -| aruba.sflow.ifIndex | | | observer.ingress.interface.id| -| aruba.sflow.intvl | | | | -| aruba.sflow.ip_address | | | destination.ip | -| aruba.sflow.mode | | | | -| aruba.sflow.new_rate | | | | -| aruba.sflow.old_rate | | | | -| aruba.sflow.operation | | | event.action | -| aruba.sflow.port | | | server.port | -| aruba.sflow.port_name | | | server.port | -| aruba.sflow.unit | | | aruba.unit | +| Docs Field | Schema Mapping | +|-------------------|--------------------------------------------| +| `` | aruba.sflow.bridge | +| `` | aruba.sflow.chain | +| `` | aruba.error.description | +| `` | aruba.sflow.dgramsize | +| `` | event.reason | +| `` | file.name | +| `` | aruba.len | +| `` | aruba.interface.id | +| `` | aruba.interface.id | +| `` | aruba.sflow.intvl | +| `` | client.ip | +| `` | client.ip | +| `` | aruba.sflow.mode | +| `` | aruba.sflow.new_rate | +| `` | aruba.sflow.old_rate | +| `` | aruba.sflow.operation | +| `` | aruba.port | +| `` | aruba.port | +| `` | aruba.unit | #### [SFTP Client events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SFTP_CLIENT.htm) | Field | Description | Type | Common | diff --git a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-cx.log-expected.json b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-cx.log-expected.json index 5a7d1103d5c..58cb7fef6c6 100644 --- a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-cx.log-expected.json +++ b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-cx.log-expected.json @@ -400,6 +400,9 @@ "event_type": "Event", "hardware": { "device": "6000RCSE4802" + }, + "rest": { + "central_source": "activate" } }, "ecs": { @@ -955,6 +958,9 @@ "event_type": "Event", "hardware": { "device": "6300-DIST-RDL" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -975,6 +981,9 @@ } }, "message": "Aruba Activate server https://www.elastic.co/security is reachable via VRF default.", + "server": { + "address": "https://www.elastic.co/security" + }, "tags": [ "preserve_original_event" ] @@ -1008,6 +1017,9 @@ } }, "message": "Switch time is synced with Aruba Activate Server https://www.elastic.co/security.", + "server": { + "address": "https://www.elastic.co/security" + }, "tags": [ "preserve_original_event" ] @@ -1021,6 +1033,13 @@ "event_type": "Event", "hardware": { "device": "6300-DIST-RDL" + }, + "rest": { + "central_location": "", + "central_source": "activate" + }, + "vrf": { + "id": "" } }, "ecs": { @@ -4429,6 +4448,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "session": { + "id": "-ZWxhc3RpYy5jby9kb2Nz" } }, "ecs": { @@ -4451,7 +4473,10 @@ "message": "Authentication failed for user satori in session -ZWxhc3RpYy5jby9kb2Nz", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "satori" + } }, { "@timestamp": "2024-08-01T15:15:46.388565-05:00", @@ -4462,6 +4487,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "session": { + "id": "ZWxhc3RpYy5jby9kb2Nz" } }, "ecs": { @@ -4484,7 +4512,10 @@ "message": "Authentication succeeded for user admin in session ZWxhc3RpYy5jby9kb2Nz", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:55:45.705314-05:00", @@ -4495,12 +4526,16 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "resource": "RoleDefault" } }, "ecs": { "version": "8.11.0" }, "event": { + "action": "PUT", "category": [ "network" ], @@ -4517,7 +4552,10 @@ "message": "Authorization succeeded for user admin, for resource RoleDefault, with action PUT", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:54:24.803858-05:00", @@ -4528,12 +4566,16 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "resource": "RoleDefault" } }, "ecs": { "version": "8.11.0" }, "event": { + "action": "POST", "category": [ "network" ], @@ -4550,7 +4592,10 @@ "message": "Authorization succeeded for user admin, for resource RoleDefault, with action POST", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:53:38.174569-05:00", @@ -4561,12 +4606,16 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "resource": "RoleDefault" } }, "ecs": { "version": "8.11.0" }, "event": { + "action": "DELETE", "category": [ "network" ], @@ -4583,7 +4632,10 @@ "message": "Authorization succeeded for user admin, for resource RoleDefault, with action DELETE", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:54:24.900661-05:00", @@ -4616,7 +4668,10 @@ "message": "admin created", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:53:38.182641-05:00", @@ -4649,7 +4704,13 @@ "message": "admin deleted /users/user_name", "tags": [ "preserve_original_event" - ] + ], + "url": { + "original": "/users/user_name" + }, + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T13:55:45.805480-05:00", @@ -4682,7 +4743,13 @@ "message": "admin modified /users/user_name", "tags": [ "preserve_original_event" - ] + ], + "url": { + "original": "/users/user_name" + }, + "user": { + "name": "admin" + } }, { "@timestamp": "2024-08-01T15:15:46.437583-05:00", @@ -4693,6 +4760,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "subscriber": "subscriber_name" } }, "ecs": { @@ -4715,7 +4785,10 @@ "message": "User: admin added subscriber: subscriber_name.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-08-01T15:16:22.055165-05:00", @@ -4726,6 +4799,10 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "subscriber": "subscriber_name", + "subscription": "subscription_name" } }, "ecs": { @@ -4759,6 +4836,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "name": "vlan_specific_mac_monitor" } }, "ecs": { @@ -4781,7 +4861,10 @@ "message": "NAE Script vlan_specific_mac_monitor has been created by user admin.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2023-11-10T10:56:21.357037-05:00", @@ -4792,6 +4875,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "name": "MAC_PAR_VLAN" } }, "ecs": { @@ -4814,7 +4900,10 @@ "message": "NAE Agent MAC_PAR_VLAN has been created by user admin.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-08-01T10:10:37.829267-05:00", @@ -4825,6 +4914,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "vrf": { + "id": "vpn-Internet" } }, "ecs": { @@ -4845,6 +4937,9 @@ } }, "message": "Aruba Activate server https://www.elastic.co/security is reachable via VRF vpn-Internet.", + "server": { + "address": "https://www.elastic.co/security" + }, "tags": [ "preserve_original_event" ] @@ -4878,6 +4973,9 @@ } }, "message": "Aruba Activate server https://www.elastic.co/security is not reachable through any supported VRF.", + "server": { + "address": "https://www.elastic.co/security" + }, "tags": [ "preserve_original_event" ] @@ -4944,6 +5042,9 @@ } }, "message": "Switch time is synced with Aruba Activate Server https://www.elastic.co/security.", + "server": { + "address": "https://www.elastic.co/security" + }, "tags": [ "preserve_original_event" ] @@ -4957,6 +5058,13 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "central_location": "", + "central_source": "activate" + }, + "vrf": { + "id": "" } }, "ecs": { @@ -4990,6 +5098,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "127.0.0.1" } }, "ecs": { @@ -5012,7 +5123,10 @@ "message": "User satori login from 127.0.0.1 for REST session has failed", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "satori" + } }, { "@timestamp": "2024-06-19T14:38:17.422545-05:00", @@ -5023,6 +5137,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "127.0.0.1" } }, "ecs": { @@ -5045,7 +5162,10 @@ "message": "User admin logged out of REST session from 127.0.0.1", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-19T14:38:17.422469-05:00", @@ -5056,6 +5176,9 @@ "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "127.0.0.1" } }, "ecs": { @@ -5078,7 +5201,13 @@ "message": "WebUI session from 127.0.0.1 with User admin timed out due to idle timeout", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + }, + "user_agent": { + "name": "WebUI" + } }, { "@timestamp": "2024-06-19T14:20:36.871390-05:00", diff --git a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log index 4493998bbdd..ed7e0e1c6b8 100644 --- a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log +++ b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log @@ -62,6 +62,38 @@ 2024-06-18T12:45:38.182641-05:00 8360-Primaire loopback[1234]: Event|901|LOG_INFO|LOOPBACK|-|Loopback Interface eth0, created 2024-06-18T12:46:38.182641-05:00 8360-Primaire loopback[1234]: Event|902|LOG_INFO|LOOPBACK|-|Loopback Interface eth0, deleted 2024-06-18T12:47:38.182641-05:00 8360-Primaire loopback[1234]: Event|903|LOG_INFO|LOOPBACK|-|Loopback Interface eth0, configured administratively up +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1001|LOG_ERR|sFlow|-|Failed to start host sFlow agent: connection_timeout +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1002|LOG_ERR|sFlow|-|Failed to read host sFlow configuration file /etc/sflow.conf: file_not_found +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1003|LOG_ERR|sFlow|-|Failed to apply sFlow configuration from bridge br0: invalid_configuration +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1004|LOG_ERR|sFlow|-|Failed to delete all iptable rules: permission_denied +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1005|LOG_ERR|sFlow|-|Failed to add INPUT iptable rules for eth0: rule_conflict +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1006|LOG_ERR|sFlow|-|sFlow initialization failed: initialization_error +2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1007|LOG_ERR|sFlow|-|Invalid packet sent by ASIC in sFlow callback: packet_malformed +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1008|LOG_ERR|sFlow|-|Unable to get netdev for interface eth1 +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1009|LOG_ERR|sFlow|-|Failed to create KNET filter as description is blank +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1010|LOG_ERR|sFlow|-|Failed to create KNET filter for: sFlow_filter +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1011|LOG_ERR|sFlow|-|The received sampled packet is null +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1012|LOG_ERR|sFlow|-|The sFlow agent is not initialized +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1013|LOG_ERR|sFlow|-|The sFlow sampler is not initialized +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1014|LOG_ERR|sFlow|-|Cannot enable/disable sFlow on an invalid port: eth0 +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1015|LOG_ERR|sFlow|-|sFlow sampler is not available on port: eth1 +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1016|LOG_ERR|sFlow|-|sFlow receiver is not available +2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1017|LOG_ERR|sFlow|-|Failed to retrieve port configuration: timeout_error +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1018|LOG_ERR|sFlow|-|Failed to set sampling rate on port eth2: permission_denied +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1019|LOG_ERR|sFlow|-|Failed to get sampling rate on port eth3: not_supported +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1020|LOG_ERR|sFlow|-|Invalid agent interface IP address: 192.168.1.1 +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1021|LOG_ERR|sFlow|-|Invalid collector IP address: 192.168.1.1 +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1022|LOG_ERR|sFlow|-|Failed to get interface statistics for unit 1 port eth0: timeout_error +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1023|LOG_INFO|sFlow|-|sFlow agent created. +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1024|LOG_INFO|sFlow|-|sFlow agent deleted. +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1025|LOG_INFO|sFlow|-|Changed sFlow sampling rate from 1000 to 2000. +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1026|LOG_INFO|sFlow|-|Set sFlow agents header len to 128. +2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1027|LOG_INFO|sFlow|-|Set sFlow agents IP to 192.168.1.1. +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1028|LOG_INFO|sFlow|-|Set max datagram size on sFlow agent to 1500. +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1029|LOG_INFO|sFlow|-|Add sFlow poller on eth0 with ifIndex 1 at interval 30. +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1030|LOG_INFO|sFlow|-|Remove sFlow poller on 1. +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1031|LOG_INFO|sFlow|-|Set polling interval of 30 on sFlow agent. +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1032|LOG_INFO|sFlow|-|sFlow sampling mode set to random. 2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1301|LOG_INFO|LACP|-|Dynamic LAG 1 created 2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1302|LOG_INFO|LACP|-|Dynamic LAG 1 deleted 2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1305|LOG_INFO|LACP|-|LACP system priority set to 100 @@ -336,6 +368,57 @@ 2024-06-20T14:04:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4405|LOG_ERR|AMM|-|Firmware image signature not valid 2024-06-20T14:05:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4406|LOG_ERR|AMM|-|Firmware image is not compatible with hardware 2024-06-20T14:06:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4407|LOG_ERR|AMM|-|Firmware image is invalid +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4501|LOG_INFO|SELFTEST|-|Selftest has started on subsystem subsystem1 +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4502|LOG_INFO|SELFTEST|-|Selftest has completed on subsystem subsystem1 +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4503|LOG_ERR|SELFTEST|-|Selftest has failed on subsystem subsystem1 with error code 1234 +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4504|LOG_ERR|SELFTEST|-|Selftest has failed on stack1/1/interface1 with error code 5678 +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4603|LOG_ERR|REST|-|Conflict in authorization configuration. Existing config::URL(/old/url), type(old_type) New config::(/new/url), type(new_type) +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4604|LOG_INFO|REST|-|Session started for user admin, session 12345 +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4605|LOG_INFO|REST|-|Session ended for user admin, session 12345 +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4606|LOG_ERR|REST|-|Authorization failed for user admin, for resource /resource, with action read +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4608|LOG_INFO|REST|-|Authorization allowed for user admin, for resource /resource, with action read +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4609|LOG_INFO|REST|-|User admin added new_user with role admin +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4610|LOG_INFO|REST|-|User admin deleted old_user +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4611|LOG_INFO|REST|-|User admin successfully changed password +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4612|LOG_WARN|REST|-|User admin password change failed +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4613|LOG_INFO|REST|-|admin has written a new switch configuration to switch_config_1 +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4614|LOG_INFO|REST|-|admin has copied switch configuration config_old to config_new +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4615|LOG_INFO|REST|-|admin has configured 8.8.8.8 DNS nameserver to 8.8.4.4 +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4616|LOG_INFO|REST|-|admin has deleted all DNS nameservers +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4617|LOG_INFO|REST|-|admin created http://www.example.com +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4621|LOG_INFO|REST|-|User: admin removed subscriber: subscriber1. +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4623|LOG_INFO|REST|-|Subscriber: subscriber1 removed subscription: subscription1. +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4624|LOG_WARN|REST|-|Unable to add new subscriber. Max number of subscribers has been reached. +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4625|LOG_WARN|REST|-|Unable to add new subscription. Max number of subscriptions for subscriber1 has been reached. +2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4627|LOG_INFO|REST|-|NAE Script script1 has been deleted by user admin. +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4629|LOG_INFO|REST|-|NAE Agent agent1 has been updated by user admin. +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4630|LOG_INFO|REST|-|NAE Agent agent1 has been deleted by user admin. +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4631|LOG_ERR|REST|-|Error rebooting switch, reboot command: reboot, error received: timeout +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4632|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default with Source IP 192.168.1.1 has been successfully established. +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4633|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Requesting new Aruba Central location from CLI/DHCP/Activate. +2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4634|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Trying to reconnect. +2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4635|LOG_INFO|REST|-|Received HPE Aruba Networking Central location San Francisco on VRF default with Source IP 192.168.1.2 +2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4636|LOG_INFO|REST|-|Received new HPE Aruba Networking Central location. Closing existing connection with Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2. +2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4637|LOG_ERR|REST|-|Internal error. Closing connection to Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2. +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4638|LOG_INFO|REST|-|Waiting for HPE Aruba Networking Central location from CLI/DHCP/Aruba Activate Server. +2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4639|LOG_INFO|REST|-|Connecting to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2. +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4640|LOG_ERR|REST|-|Failed to connect to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2 +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4641|LOG_INFO|REST|-|HPE Aruba Networking Central is disabled. +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4642|LOG_INFO|REST|-|HPE Aruba Networking Central is disabled. Closing connection to Aruba Central on location New York on VRF default with Source IP 192.168.1.1 +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4643|LOG_INFO|REST|-|HPE Aruba Networking Central is enabled. +2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4652|LOG_WARN|REST|-|Central connected, any config change through rest POST operation may not be persistent. If central reapplies the config, change can be overwritten +2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4653|LOG_INFO|REST|-|User admin has configured read-only for configuration lockout +2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4654|LOG_INFO|REST|-|HPE Aruba Networking Central support mode is enabled for a vtysh session +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4649|LOG_ERR|REST|-|Unable to sync switch time with Aruba Activate Server 192.168.1.2 via VRF default. +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4650|LOG_INFO|REST|-|Unable to fetch HPE Aruba Networking Central location South Africa from DHCP via VRF default. +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4651|LOG_INFO|REST|-|HPE Aruba Networking Central location San Francisco successfully fetched from DHCP via VRF default +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4655|LOG_INFO|REST|-|User admin logged in from identity_1 through REST session +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4656|LOG_ERR|REST|-|User admin login from identity_1 for REST session has failed +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4657|LOG_INFO|REST|-|User admin logged out of REST session from identity_1 +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4658|LOG_WARN|REST|-|REST session from identity_1 with User admin is rejected because maximum session limit is reached +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4660|LOG_INFO|REST|-|REST server is enabled on VRF default +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4661|LOG_INFO|REST|-|REST server is disabled on VRF default +2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4662|LOG_INFO|REST|-|User satori login from 127.0.0.1 for REST session has failed since the user is trying to login through an interface which is not allowed. Allowed interfaces are: interface1 2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-mac[1234]: Event|4801|LOG_INFO|MACLEARN|-|MAC 00:1A:2B:3C:4D:5E moved from port eth0 to port eth1 on VLAN 10 2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-mac[1234]: Event|4802|LOG_INFO|MACLEARN|-|All dynamic MAC addresses on VLAN 10 were flushed 2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-mac[1234]: Event|4803|LOG_INFO|MACLEARN|-|All dynamic MAC addresses on port eth0 were flushed diff --git a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json index 9dc9f88254e..006a0adc323 100644 --- a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json +++ b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json @@ -2401,14 +2401,14 @@ "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" + "sflow": { + "operation": "start" } }, "ecs": { @@ -2418,17 +2418,18 @@ "category": [ "network" ], - "code": "1301", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1301|LOG_INFO|LACP|-|Dynamic LAG 1 created" + "code": "1001", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1001|LOG_ERR|sFlow|-|Failed to start host sFlow agent: connection_timeout", + "reason": "connection_timeout" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Dynamic LAG 1 created", + "message": "Failed to start host sFlow agent: connection_timeout", "tags": [ "preserve_original_event" ] @@ -2437,14 +2438,14 @@ "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" + "sflow": { + "operation": "read" } }, "ecs": { @@ -2454,33 +2455,38 @@ "category": [ "network" ], - "code": "1302", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1302|LOG_INFO|LACP|-|Dynamic LAG 1 deleted" + "code": "1002", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1002|LOG_ERR|sFlow|-|Failed to read host sFlow configuration file /etc/sflow.conf: file_not_found", + "reason": "file_not_found" + }, + "file": { + "name": "/etc/sflow.conf" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Dynamic LAG 1 deleted", + "message": "Failed to read host sFlow configuration file /etc/sflow.conf: file_not_found", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "lacp": { - "system_priority": "100" + "sflow": { + "bridge": "br0", + "operation": "apply" } }, "ecs": { @@ -2490,36 +2496,31 @@ "category": [ "network" ], - "code": "1305", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1305|LOG_INFO|LACP|-|LACP system priority set to 100" + "code": "1003", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1003|LOG_ERR|sFlow|-|Failed to apply sFlow configuration from bridge br0: invalid_configuration", + "reason": "invalid_configuration" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP system priority set to 100", + "message": "Failed to apply sFlow configuration from bridge br0: invalid_configuration", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "lacp": { - "mode": "active" } }, "ecs": { @@ -2529,33 +2530,36 @@ "category": [ "network" ], - "code": "1306", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1306|LOG_INFO|LACP|-|LACP mode set to active for LAG 1" + "code": "1004", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1004|LOG_ERR|sFlow|-|Failed to delete all iptable rules: permission_denied", + "reason": "permission_denied" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP mode set to active for LAG 1", + "message": "Failed to delete all iptable rules: permission_denied", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "lacp": { - "system_id": "00:11:22:33:44:55" + "port": "eth0", + "sflow": { + "chain": "INPUT", + "operation": "add" } }, "ecs": { @@ -2565,36 +2569,31 @@ "category": [ "network" ], - "code": "1307", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1307|LOG_INFO|LACP|-|LACP system ID set to 00:11:22:33:44:55" + "code": "1005", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1005|LOG_ERR|sFlow|-|Failed to add INPUT iptable rules for eth0: rule_conflict", + "reason": "rule_conflict" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP system ID set to 00:11:22:33:44:55", + "message": "Failed to add INPUT iptable rules for eth0: rule_conflict", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "lacp": { - "rate": "fast" } }, "ecs": { @@ -2604,39 +2603,30 @@ "category": [ "network" ], - "code": "1308", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1308|LOG_INFO|LACP|-|LACP rate set to fast for LAG 1" + "code": "1006", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1006|LOG_ERR|sFlow|-|sFlow initialization failed: initialization_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP rate set to fast for LAG 1", + "message": "sFlow initialization failed: initialization_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "interface": { - "id": "eth1" - }, - "lacp": { - "fsm_state": "down" } }, "ecs": { @@ -2646,33 +2636,33 @@ "category": [ "network" ], - "code": "1311", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1311|LOG_WARN|LACP|-|Partner is lost (timed out) for interface eth1 LAG 1. State: down" + "code": "1007", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1007|LOG_ERR|sFlow|-|Invalid packet sent by ASIC in sFlow callback: packet_malformed" }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Partner is lost (timed out) for interface eth1 LAG 1. State: down", + "message": "Invalid packet sent by ASIC in sFlow callback: packet_malformed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" + "interface": { + "id": "eth1" } }, "ecs": { @@ -2682,33 +2672,30 @@ "category": [ "network" ], - "code": "1312", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1312|LOG_ERR|LACP|-|Failed to create LAG 1" + "code": "1008", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1008|LOG_ERR|sFlow|-|Unable to get netdev for interface eth1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Failed to create LAG 1", + "message": "Unable to get netdev for interface eth1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" } }, "ecs": { @@ -2718,36 +2705,33 @@ "category": [ "network" ], - "code": "1313", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1313|LOG_INFO|LACP|-|LAG 1 set as VSX" + "code": "1009", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1009|LOG_ERR|sFlow|-|Failed to create KNET filter as description is blank" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LAG 1 set as VSX", + "message": "Failed to create KNET filter as description is blank", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" + }, + "error": { + "description": "sFlow_filter" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "lacp": { - "fallback_mode": "active" } }, "ecs": { @@ -2757,35 +2741,31 @@ "category": [ "network" ], - "code": "1315", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1315|LOG_ERR|LACP|-|LACP fallback mode set to active for lag 1" + "code": "1010", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1010|LOG_ERR|sFlow|-|Failed to create KNET filter for: sFlow_filter" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP fallback mode set to active for lag 1", + "message": "Failed to create KNET filter for: sFlow_filter", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "timeout": 30 + } }, "ecs": { "version": "8.11.0" @@ -2794,35 +2774,31 @@ "category": [ "network" ], - "code": "1316", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1316|LOG_ERR|LACP|-|LACP fallback timeout set to 30 for lag 1" + "code": "1011", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1011|LOG_ERR|sFlow|-|The received sampled packet is null" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP fallback timeout set to 30 for lag 1", + "message": "The received sampled packet is null", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "timeout": 30 + } }, "ecs": { "version": "8.11.0" @@ -2831,36 +2807,30 @@ "category": [ "network" ], - "code": "1317", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1317|LOG_ERR|LACP|-|LACP fallback timeout 30 expired for lag 1" + "code": "1012", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1012|LOG_ERR|sFlow|-|The sFlow agent is not initialized" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP fallback timeout 30 expired for lag 1", + "message": "The sFlow agent is not initialized", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -2870,34 +2840,32 @@ "category": [ "network" ], - "code": "1318", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1318|LOG_ERR|LACP|-|Interface eth0 enabled by fallback for lag 1" + "code": "1013", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1013|LOG_ERR|sFlow|-|The sFlow sampler is not initialized" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Interface eth0 enabled by fallback for lag 1", + "message": "The sFlow sampler is not initialized", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "lacp": { - "mode": "src-dst-ip" - } + "port": "eth0" }, "ecs": { "version": "8.11.0" @@ -2906,37 +2874,32 @@ "category": [ "network" ], - "code": "1319", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1319|LOG_INFO|LACP|-|LAG global load balancing mode is set to src-dst-ip" + "code": "1014", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1014|LOG_ERR|sFlow|-|Cannot enable/disable sFlow on an invalid port: eth0" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LAG global load balancing mode is set to src-dst-ip", + "message": "Cannot enable/disable sFlow on an invalid port: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" - }, - "lacp": { - "mode": "src-dst-ip" - } + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -2945,38 +2908,30 @@ "category": [ "network" ], - "code": "1320", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1320|LOG_INFO|LACP|-|LAG load balancing mode is set to src-dst-ip for lag 1" + "code": "1015", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1015|LOG_ERR|sFlow|-|sFlow sampler is not available on port: eth1" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LAG load balancing mode is set to src-dst-ip for lag 1", + "message": "sFlow sampler is not available on port: eth1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "name": "eth0" - }, - "lacp": { - "lag_number": 1, - "lag_speed": 100, - "port_speed": 1000 } }, "ecs": { @@ -2986,36 +2941,30 @@ "category": [ "network" ], - "code": "1322", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1322|LOG_INFO|LACP|-|Interface eth0 cannot be part of Lag 1. Speed mismatched (Interface speed 1000Mbps Lag base speed 100Mbps). throttle_count: 100" + "code": "1016", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1016|LOG_ERR|sFlow|-|sFlow receiver is not available" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Interface eth0 cannot be part of Lag 1. Speed mismatched (Interface speed 1000Mbps Lag base speed 100Mbps). throttle_count: 100", + "message": "sFlow receiver is not available", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1" - }, - "lacp": { - "fallback": "enabled" } }, "ecs": { @@ -3025,31 +2974,33 @@ "category": [ "network" ], - "code": "1323", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1323|LOG_INFO|LACP|-|Fallback is enabled for LAG 1" + "code": "1017", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1017|LOG_ERR|sFlow|-|Failed to retrieve port configuration: timeout_error", + "reason": "timeout_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Fallback is enabled for LAG 1", + "message": "Failed to retrieve port configuration: timeout_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LACP" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "port": "eth2" }, "ecs": { "version": "8.11.0" @@ -3058,35 +3009,33 @@ "category": [ "network" ], - "code": "1324", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1324|LOG_INFO|LACP|-|LACP Graceful Shut is initiated" + "code": "1018", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1018|LOG_ERR|sFlow|-|Failed to set sampling rate on port eth2: permission_denied", + "reason": "permission_denied" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lacp", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LACP Graceful Shut is initiated", + "message": "Failed to set sampling rate on port eth2: permission_denied", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1001" - }, - "unit": "1" + "port": "eth3" }, "ecs": { "version": "8.11.0" @@ -3095,114 +3044,105 @@ "category": [ "network" ], - "code": "1401", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1401|LOG_INFO|LAG|-|Trunk set succeeds unit 1 lag_id 1001" + "code": "1019", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1019|LOG_ERR|sFlow|-|Failed to get sampling rate on port eth3: not_supported", + "reason": "not_supported" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Trunk set succeeds unit 1 lag_id 1001", + "message": "Failed to get sampling rate on port eth3: not_supported", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1001" - }, - "unit": "1" + } + }, + "client": { + "ip": "192.168.1.1" }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1402", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1402|LOG_ERR|LAG|-|Lag creation failed unit 1 lag_id 1001 rc 1 error some_error", - "reason": "some_error" + "code": "1020", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1020|LOG_ERR|sFlow|-|Invalid agent interface IP address: 192.168.1.1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Lag creation failed unit 1 lag_id 1001 rc 1 error some_error", + "message": "Invalid agent interface IP address: 192.168.1.1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "instance": { - "id": "1001" - }, - "unit": "1" + } + }, + "client": { + "ip": "192.168.1.1" }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1403", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1403|LOG_ERR|LAG|-|Destroy lag failed on unit 1 lag_id 1001 rc 1 error some_error", - "reason": "some_error" + "code": "1021", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1021|LOG_ERR|sFlow|-|Invalid collector IP address: 192.168.1.1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Destroy lag failed on unit 1 lag_id 1001 rc 1 error some_error", + "message": "Invalid collector IP address: 192.168.1.1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "2", + "port": "eth0", "unit": "1" }, "ecs": { @@ -3212,216 +3152,173 @@ "category": [ "network" ], - "code": "1404", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1404|LOG_INFO|LAG|-|Trunk member add port succeeds on unit 1 hw_port 2 tid 3" + "code": "1022", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1022|LOG_ERR|sFlow|-|Failed to get interface statistics for unit 1 port eth0: timeout_error", + "reason": "timeout_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Trunk member add port succeeds on unit 1 hw_port 2 tid 3", - "process": { - "thread": { - "id": 3 - } - }, + "message": "Failed to get interface statistics for unit 1 port eth0: timeout_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "port": "2" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1405", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1405|LOG_ERR|LAG|-|Trunk port attach error on hw_port 2 tid 3 rc 1 some_error", - "reason": "some_error" + "code": "1023", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1023|LOG_INFO|sFlow|-|sFlow agent created." }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Trunk port attach error on hw_port 2 tid 3 rc 1 some_error", - "process": { - "thread": { - "id": 3 - } - }, + "message": "sFlow agent created.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "port": "2" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1406", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1406|LOG_ERR|LAG|-|Failed to set egress enable on hw_port 2 tid 3 rc 1 error some_error", - "reason": "some_error" + "code": "1024", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1024|LOG_INFO|sFlow|-|sFlow agent deleted." }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Failed to set egress enable on hw_port 2 tid 3 rc 1 error some_error", - "process": { - "thread": { - "id": 3 - } - }, + "message": "sFlow agent deleted.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "2" + "sflow": { + "new_rate": "2000", + "old_rate": "1000" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1407", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1407|LOG_ERR|LAG|-|Failed to delete hw_port 2 from tid 3 rc 1 error some_error", - "reason": "some_error" + "code": "1025", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1025|LOG_INFO|sFlow|-|Changed sFlow sampling rate from 1000 to 2000." }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Failed to delete hw_port 2 from tid 3 rc 1 error some_error", - "process": { - "thread": { - "id": 3 - } - }, + "message": "Changed sFlow sampling rate from 1000 to 2000.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1001" - }, - "lag": { - "psc": "2" - }, - "unit": "1" + "len": 128 }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "1" - }, "event": { "category": [ "network" ], - "code": "1408", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1408|LOG_ERR|LAG|-|Trunk psc set failed on unit 1 lag_id 1001 psc 2 rc 1 error some_error", - "reason": "some_error" + "code": "1026", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1026|LOG_INFO|sFlow|-|Set sFlow agents header len to 128." }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Trunk psc set failed on unit 1 lag_id 1001 psc 2 rc 1 error some_error", + "message": "Set sFlow agents header len to 128.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" - }, - "lag": { - "mode": "src-dst-ip" } }, + "client": { + "ip": "192.168.1.1" + }, "ecs": { "version": "8.11.0" }, @@ -3429,35 +3326,34 @@ "category": [ "network" ], - "code": "1409", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1409|LOG_INFO|LAG|-|LAG eth0, set to load balance mode to src-dst-ip" + "code": "1027", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1027|LOG_INFO|sFlow|-|Set sFlow agents IP to 192.168.1.1." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "LAG eth0, set to load balance mode to src-dst-ip", + "message": "Set sFlow agents IP to 192.168.1.1.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - }, - "port": "eth1" + "sflow": { + "dgramsize": 1500 + } }, "ecs": { "version": "8.11.0" @@ -3466,35 +3362,38 @@ "category": [ "network" ], - "code": "1410", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1410|LOG_INFO|LAG|-|Add port eth1 to LAG eth0" + "code": "1028", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1028|LOG_INFO|sFlow|-|Set max datagram size on sFlow agent to 1500." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Add port eth1 to LAG eth0", + "message": "Set max datagram size on sFlow agent to 1500.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, "interface": { - "id": "eth0" + "id": "1" }, - "port": "eth1" + "port": "eth0", + "sflow": { + "intvl": "30" + } }, "ecs": { "version": "8.11.0" @@ -3503,35 +3402,34 @@ "category": [ "network" ], - "code": "1411", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1411|LOG_INFO|LAG|-|Remove port eth1 from LAG eth0" + "code": "1029", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1029|LOG_INFO|sFlow|-|Add sFlow poller on eth0 with ifIndex 1 at interval 30." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Remove port eth1 from LAG eth0", + "message": "Add sFlow poller on eth0 with ifIndex 1 at interval 30.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, "interface": { - "id": "eth0" - }, - "port": "eth1" + "id": " 1" + } }, "ecs": { "version": "8.11.0" @@ -3540,40 +3438,34 @@ "category": [ "network" ], - "code": "1412", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1412|LOG_INFO|LAG|-|Add port eth1 to vlan 10 for L3 LAG eth0" + "code": "1030", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1030|LOG_INFO|sFlow|-|Remove sFlow poller on 1." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Add port eth1 to vlan 10 for L3 LAG eth0", - "network": { - "vlan": { - "id": "10" - } - }, + "message": "Remove sFlow poller on 1.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - }, - "port": "eth1" + "sflow": { + "intvl": "30" + } }, "ecs": { "version": "8.11.0" @@ -3582,38 +3474,33 @@ "category": [ "network" ], - "code": "1413", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1413|LOG_INFO|LAG|-|Remove port eth1 to vlan 10 for L3 LAG eth0" + "code": "1031", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1031|LOG_INFO|sFlow|-|Set polling interval of 30 on sFlow agent." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Remove port eth1 to vlan 10 for L3 LAG eth0", - "network": { - "vlan": { - "id": "10" - } - }, + "message": "Set polling interval of 30 on sFlow agent.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LAG" + "category": "sFlow" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "sflow": { + "mode": "random" } }, "ecs": { @@ -3623,17 +3510,17 @@ "category": [ "network" ], - "code": "1414", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1414|LOG_INFO|LAG|-|Destroy L3 LAG interface eth0" + "code": "1032", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-sflow[1234]: Event|1032|LOG_INFO|sFlow|-|sFlow sampling mode set to random." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-lag", + "appname": "hpe-sflow", "procid": "1234" } }, - "message": "Destroy L3 LAG interface eth0", + "message": "sFlow sampling mode set to random.", "tags": [ "preserve_original_event" ] @@ -3642,11 +3529,14 @@ "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" } }, "ecs": { @@ -3656,17 +3546,17 @@ "category": [ "network" ], - "code": "1501", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1501|LOG_ERR|COPP|-|CoPP initialization failed" + "code": "1301", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1301|LOG_INFO|LACP|-|Dynamic LAG 1 created" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "CoPP initialization failed", + "message": "Dynamic LAG 1 created", "tags": [ "preserve_original_event" ] @@ -3675,11 +3565,14 @@ "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" } }, "ecs": { @@ -3689,30 +3582,33 @@ "category": [ "network" ], - "code": "1502", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1502|LOG_INFO|COPP|-|COPP initialization successful" + "code": "1302", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1302|LOG_INFO|LACP|-|Dynamic LAG 1 deleted" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "COPP initialization successful", + "message": "Dynamic LAG 1 deleted", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "lacp": { + "system_priority": "100" } }, "ecs": { @@ -3722,30 +3618,36 @@ "category": [ "network" ], - "code": "1503", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1503|LOG_ERR|COPP|-|Ingress FP Group create failed" + "code": "1305", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1305|LOG_INFO|LACP|-|LACP system priority set to 100" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Ingress FP Group create failed", + "message": "LACP system priority set to 100", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" + }, + "lacp": { + "mode": "active" } }, "ecs": { @@ -3755,30 +3657,33 @@ "category": [ "network" ], - "code": "1504", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1504|LOG_ERR|COPP|-|Egress FP Group create failed" + "code": "1306", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1306|LOG_INFO|LACP|-|LACP mode set to active for LAG 1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Egress FP Group create failed", + "message": "LACP mode set to active for LAG 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "lacp": { + "system_id": "00:11:22:33:44:55" } }, "ecs": { @@ -3788,33 +3693,36 @@ "category": [ "network" ], - "code": "1505", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1505|LOG_ERR|COPP|-|Programming defaults failed" + "code": "1307", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1307|LOG_INFO|LACP|-|LACP system ID set to 00:11:22:33:44:55" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Programming defaults failed", + "message": "LACP system ID set to 00:11:22:33:44:55", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "COPP" - }, - "copp": { - "class": "myClass" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" + }, + "lacp": { + "rate": "fast" } }, "ecs": { @@ -3824,33 +3732,39 @@ "category": [ "network" ], - "code": "1506", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1506|LOG_ERR|COPP|-|Packet class programming failed for myClass" + "code": "1308", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1308|LOG_INFO|LACP|-|LACP rate set to fast for LAG 1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Packet class programming failed for myClass", + "message": "LACP rate set to fast for LAG 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "COPP" - }, - "copp": { - "class": "myClass" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" + }, + "interface": { + "id": "eth1" + }, + "lacp": { + "fsm_state": "down" } }, "ecs": { @@ -3860,33 +3774,33 @@ "category": [ "network" ], - "code": "1507", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1507|LOG_ERR|COPP|-|Failed to program ingress field processor rule for myClass" + "code": "1311", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1311|LOG_WARN|LACP|-|Partner is lost (timed out) for interface eth1 LAG 1. State: down" }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Failed to program ingress field processor rule for myClass", + "message": "Partner is lost (timed out) for interface eth1 LAG 1. State: down", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "COPP" - }, - "copp": { - "class": "myClass" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "instance": { + "id": "1" } }, "ecs": { @@ -3896,32 +3810,34 @@ "category": [ "network" ], - "code": "1508", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1508|LOG_ERR|COPP|-|Failed to program egress rule for myClass" + "code": "1312", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1312|LOG_ERR|LACP|-|Failed to create LAG 1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Failed to program egress rule for myClass", + "message": "Failed to create LAG 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "slot": 3 + "instance": { + "id": "1" + } }, "ecs": { "version": "8.11.0" @@ -3930,32 +3846,37 @@ "category": [ "network" ], - "code": "1509", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1509|LOG_ERR|COPP|-|CoPP initial initialization failed on slot 3" + "code": "1313", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1313|LOG_INFO|LACP|-|LAG 1 set as VSX" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "CoPP initial initialization failed on slot 3", + "message": "LAG 1 set as VSX", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "slot": 3 + "instance": { + "id": "1" + }, + "lacp": { + "fallback_mode": "active" + } }, "ecs": { "version": "8.11.0" @@ -3964,32 +3885,35 @@ "category": [ "network" ], - "code": "1510", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1510|LOG_ERR|COPP|-|CoPP final initialization failed on slot 3" + "code": "1315", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1315|LOG_ERR|LACP|-|LACP fallback mode set to active for lag 1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "CoPP final initialization failed on slot 3", + "message": "LACP fallback mode set to active for lag 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "COPP" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "slot": 3 + "instance": { + "id": "1" + }, + "timeout": 30 }, "ecs": { "version": "8.11.0" @@ -3998,35 +3922,35 @@ "category": [ "network" ], - "code": "1511", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1511|LOG_ERR|COPP|-|CoPP deinitialization failed on slot 3" + "code": "1316", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1316|LOG_ERR|LACP|-|LACP fallback timeout set to 30 for lag 1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "CoPP deinitialization failed on slot 3", + "message": "LACP fallback timeout set to 30 for lag 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "COPP" - }, - "copp": { - "class": "myClass" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "slot": 3 + "instance": { + "id": "1" + }, + "timeout": 30 }, "ecs": { "version": "8.11.0" @@ -4035,35 +3959,37 @@ "category": [ "network" ], - "code": "1512", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1512|LOG_ERR|COPP|-|Failed to configure hardware for CoPP on slot 3 class myClass" + "code": "1317", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1317|LOG_ERR|LACP|-|LACP fallback timeout 30 expired for lag 1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Failed to configure hardware for CoPP on slot 3 class myClass", + "message": "LACP fallback timeout 30 expired for lag 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "COPP" - }, - "copp": { - "class": "myClass" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "slot": 3 + "instance": { + "id": "1" + }, + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -4072,33 +3998,33 @@ "category": [ "network" ], - "code": "1513", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1513|LOG_ERR|COPP|-|Failed to retrieve CoPP statistics from slot 3 class myClass" + "code": "1318", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1318|LOG_ERR|LACP|-|Interface eth0 enabled by fallback for lag 1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-copp", - "procid": "1233" + "appname": "hpe-lacp", + "procid": "1234" } }, - "message": "Failed to retrieve CoPP statistics from slot 3 class myClass", + "message": "Interface eth0 enabled by fallback for lag 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "lacp": { + "mode": "src-dst-ip" } }, "ecs": { @@ -4108,33 +4034,36 @@ "category": [ "network" ], - "code": "1701", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1701|LOG_INFO|LAYER3INTF|-|L3-Interface eth0, created" + "code": "1319", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1319|LOG_INFO|LACP|-|LAG global load balancing mode is set to src-dst-ip" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lacp", "procid": "1234" } }, - "message": "L3-Interface eth0, created", + "message": "LAG global load balancing mode is set to src-dst-ip", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "instance": { + "id": "1" + }, + "lacp": { + "mode": "src-dst-ip" } }, "ecs": { @@ -4144,33 +4073,38 @@ "category": [ "network" ], - "code": "1702", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1702|LOG_INFO|LAYER3INTF|-|L3-Interface eth0, deleted" + "code": "1320", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1320|LOG_INFO|LACP|-|LAG load balancing mode is set to src-dst-ip for lag 1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lacp", "procid": "1234" } }, - "message": "L3-Interface eth0, deleted", + "message": "LAG load balancing mode is set to src-dst-ip for lag 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, "interface": { - "id": "eth0" + "name": "eth0" + }, + "lacp": { + "lag_number": 1, + "lag_speed": 100, + "port_speed": 1000 } }, "ecs": { @@ -4180,38 +4114,36 @@ "category": [ "network" ], - "code": "1704", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1704|LOG_ERR|LAYER3INTF|-|Failed to create 100 for layer 3 interface eth0" + "code": "1322", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1322|LOG_INFO|LACP|-|Interface eth0 cannot be part of Lag 1. Speed mismatched (Interface speed 1000Mbps Lag base speed 100Mbps). throttle_count: 100" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lacp", "procid": "1234" } }, - "message": "Failed to create 100 for layer 3 interface eth0", - "network": { - "vlan": { - "id": "100" - } - }, + "message": "Interface eth0 cannot be part of Lag 1. Speed mismatched (Interface speed 1000Mbps Lag base speed 100Mbps). throttle_count: 100", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "instance": { + "id": "1" + }, + "lacp": { + "fallback": "enabled" } }, "ecs": { @@ -4221,39 +4153,30 @@ "category": [ "network" ], - "code": "1705", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1705|LOG_ERR|LAYER3INTF|-|Failed to destroy layer 3 interface eth0 vlan 100, error: some_error", - "reason": "some_error" + "code": "1323", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1323|LOG_INFO|LACP|-|Fallback is enabled for LAG 1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lacp", "procid": "1234" } }, - "message": "Failed to destroy layer 3 interface eth0 vlan 100, error: some_error", - "network": { - "vlan": { - "id": "100" - } - }, + "message": "Fallback is enabled for LAG 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LACP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -4263,32 +4186,35 @@ "category": [ "network" ], - "code": "1706", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1706|LOG_ERR|LAYER3INTF|-|Failed to delete an l3 interface eth0, error: some_error", - "reason": "some_error" + "code": "1324", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lacp[1234]: Event|1324|LOG_INFO|LACP|-|LACP Graceful Shut is initiated" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lacp", "procid": "1234" } }, - "message": "Failed to delete an l3 interface eth0, error: some_error", + "message": "LACP Graceful Shut is initiated", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "instance": { + "id": "1001" + }, + "unit": "1" }, "ecs": { "version": "8.11.0" @@ -4297,114 +4223,115 @@ "category": [ "network" ], - "code": "1707", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1707|LOG_ERR|LAYER3INTF|-|Failed to add L3 host entry for ip 192.168.1.1, error: some_error", - "reason": "some_error" - }, - "host": { - "ip": [ - "192.168.1.1" - ] + "code": "1401", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1401|LOG_INFO|LAG|-|Trunk set succeeds unit 1 lag_id 1001" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Failed to add L3 host entry for ip 192.168.1.1, error: some_error", + "message": "Trunk set succeeds unit 1 lag_id 1001", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "instance": { + "id": "1001" + }, + "unit": "1" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "1" + }, "event": { "category": [ "network" ], - "code": "1708", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1708|LOG_INFO|LAYER3INTF|-|Added L3 host entry for ip 192.168.1.1" - }, - "host": { - "ip": [ - "192.168.1.1" - ] + "code": "1402", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1402|LOG_ERR|LAG|-|Lag creation failed unit 1 lag_id 1001 rc 1 error some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Added L3 host entry for ip 192.168.1.1", + "message": "Lag creation failed unit 1 lag_id 1001 rc 1 error some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "instance": { + "id": "1001" + }, + "unit": "1" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "1" + }, "event": { "category": [ "network" ], - "code": "1709", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1709|LOG_ERR|LAYER3INTF|-|Failed to delete L3 host entry for ip 192.168.1.1, error: some_error", + "code": "1403", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1403|LOG_ERR|LAG|-|Destroy lag failed on unit 1 lag_id 1001 rc 1 error some_error", "reason": "some_error" }, - "host": { - "ip": [ - "192.168.1.1" - ] - }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Failed to delete L3 host entry for ip 192.168.1.1, error: some_error", + "message": "Destroy lag failed on unit 1 lag_id 1001 rc 1 error some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "port": "2", + "unit": "1" }, "ecs": { "version": "8.11.0" @@ -4413,136 +4340,149 @@ "category": [ "network" ], - "code": "1710", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1710|LOG_INFO|LAYER3INTF|-|Deleted L3 host entry for ip 192.168.1.1" - }, - "host": { - "ip": [ - "192.168.1.1" - ] + "code": "1404", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1404|LOG_INFO|LAG|-|Trunk member add port succeeds on unit 1 hw_port 2 tid 3" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Deleted L3 host entry for ip 192.168.1.1", + "message": "Trunk member add port succeeds on unit 1 hw_port 2 tid 3", + "process": { + "thread": { + "id": 3 + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "port": "2" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "1" + }, "event": { "category": [ "network" ], - "code": "1711", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1711|LOG_ERR|LAYER3INTF|-|Failed to get L3 host hit for ip 192.168.1.1" - }, - "host": { - "ip": [ - "192.168.1.1" - ] + "code": "1405", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1405|LOG_ERR|LAG|-|Trunk port attach error on hw_port 2 tid 3 rc 1 some_error", + "reason": "some_error" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Failed to get L3 host hit for ip 192.168.1.1", + "message": "Trunk port attach error on hw_port 2 tid 3 rc 1 some_error", + "process": { + "thread": { + "id": 3 + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "port": "2" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "1" + }, "event": { "category": [ "network" ], - "code": "1712", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1712|LOG_ERR|LAYER3INTF|-|L3 interface error: some_error", + "code": "1406", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1406|LOG_ERR|LAG|-|Failed to set egress enable on hw_port 2 tid 3 rc 1 error some_error", "reason": "some_error" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "L3 interface error: some_error", + "message": "Failed to set egress enable on hw_port 2 tid 3 rc 1 error some_error", + "process": { + "thread": { + "id": 3 + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "l3": { - "nexthop": "192.168.1.2" - }, - "prefix": "192.168.1.0/24" + "port": "2" }, "ecs": { "version": "8.11.0" }, - "event": { - "category": [ + "error": { + "code": "1" + }, + "event": { + "category": [ "network" ], - "code": "1713", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1713|LOG_INFO|LAYER3INTF|-|Added Nexthop 192.168.1.2, egress_id 1001, for route 192.168.1.0/24" + "code": "1407", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1407|LOG_ERR|LAG|-|Failed to delete hw_port 2 from tid 3 rc 1 error some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Added Nexthop 192.168.1.2, egress_id 1001, for route 192.168.1.0/24", - "observer": { - "egress": { - "interface": { - "id": "1001" - } + "message": "Failed to delete hw_port 2 from tid 3 rc 1 error some_error", + "process": { + "thread": { + "id": 3 } }, "tags": [ @@ -4550,53 +4490,65 @@ ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "l3": { - "nexthop": "192.168.1.2" + "instance": { + "id": "1001" }, - "prefix": "192.168.1.0/24" + "lag": { + "psc": "2" + }, + "unit": "1" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "1" + }, "event": { "category": [ "network" ], - "code": "1714", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1714|LOG_INFO|LAYER3INTF|-|Delete Nexthop 192.168.1.2 for route 192.168.1.0/24" + "code": "1408", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1408|LOG_ERR|LAG|-|Trunk psc set failed on unit 1 lag_id 1001 psc 2 rc 1 error some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Delete Nexthop 192.168.1.2 for route 192.168.1.0/24", + "message": "Trunk psc set failed on unit 1 lag_id 1001 psc 2 rc 1 error some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "prefix": "192.168.1.0/24" + "interface": { + "id": "eth0" + }, + "lag": { + "mode": "src-dst-ip" + } }, "ecs": { "version": "8.11.0" @@ -4605,32 +4557,35 @@ "category": [ "network" ], - "code": "1715", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1715|LOG_INFO|LAYER3INTF|-|Added route 192.168.1.0/24" + "code": "1409", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1409|LOG_INFO|LAG|-|LAG eth0, set to load balance mode to src-dst-ip" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Added route 192.168.1.0/24", + "message": "LAG eth0, set to load balance mode to src-dst-ip", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "state": "up" + "interface": { + "id": "eth0" + }, + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -4639,32 +4594,35 @@ "category": [ "network" ], - "code": "1716", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1716|LOG_INFO|LAYER3INTF|-|Update: route state: up" + "code": "1410", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1410|LOG_INFO|LAG|-|Add port eth1 to LAG eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Update: route state: up", + "message": "Add port eth1 to LAG eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "prefix": "192.168.1.0/24" + "interface": { + "id": "eth0" + }, + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -4673,32 +4631,35 @@ "category": [ "network" ], - "code": "1717", - "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1717|LOG_INFO|LAYER3INTF|-|Delete route 192.168.1.0/24" + "code": "1411", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1411|LOG_INFO|LAG|-|Remove port eth1 from LAG eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Delete route 192.168.1.0/24", + "message": "Remove port eth1 from LAG eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:02:38.182641-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "prefix": "192.168.1.0/24" + "interface": { + "id": "eth0" + }, + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -4707,33 +4668,40 @@ "category": [ "network" ], - "code": "1718", - "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1718|LOG_ERR|LAYER3INTF|-|Delete route 192.168.1.0/24, error: some_error", - "reason": "some_error" + "code": "1412", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1412|LOG_INFO|LAG|-|Add port eth1 to vlan 10 for L3 LAG eth0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Delete route 192.168.1.0/24, error: some_error", + "message": "Add port eth1 to vlan 10 for L3 LAG eth0", + "network": { + "vlan": { + "id": "10" + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:03:38.182641-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "prefix": "192.168.1.0/24" + "interface": { + "id": "eth0" + }, + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -4742,33 +4710,39 @@ "category": [ "network" ], - "code": "1719", - "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1719|LOG_ERR|LAYER3INTF|-|Add route 192.168.1.0/24, error: some_error", - "reason": "some_error" + "code": "1413", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1413|LOG_INFO|LAG|-|Remove port eth1 to vlan 10 for L3 LAG eth0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Add route 192.168.1.0/24, error: some_error", + "message": "Remove port eth1 to vlan 10 for L3 LAG eth0", + "network": { + "vlan": { + "id": "10" + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:04:38.182641-05:00", + "@timestamp": "2024-06-18T12:58:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "LAG" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth1" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -4777,36 +4751,31 @@ "category": [ "network" ], - "code": "1720", - "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1720|LOG_ERR|LAYER3INTF|-|Error creating egress object for port eth1, error: some_error", - "reason": "some_error" + "code": "1414", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-lag[1234]: Event|1414|LOG_INFO|LAG|-|Destroy L3 LAG interface eth0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", + "appname": "hpe-lag", "procid": "1234" } }, - "message": "Error creating egress object for port eth1, error: some_error", + "message": "Destroy L3 LAG interface eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:05:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" - }, - "port": "eth1" + } }, "ecs": { "version": "8.11.0" @@ -4815,39 +4784,31 @@ "category": [ "network" ], - "code": "1721", - "original": "2024-06-18T13:05:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1721|LOG_INFO|LAYER3INTF|-|Created L3 egress ID 1001 for port eth1 intf eth0" + "code": "1501", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1501|LOG_ERR|COPP|-|CoPP initialization failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" - } - }, - "message": "Created L3 egress ID 1001 for port eth1 intf eth0", - "observer": { - "egress": { - "interface": { - "id": "1001" - } + "appname": "hpe-copp", + "procid": "1233" } }, + "message": "CoPP initialization failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:06:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "port": "eth1" + } }, "ecs": { "version": "8.11.0" @@ -4856,33 +4817,31 @@ "category": [ "network" ], - "code": "1722", - "original": "2024-06-18T13:06:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1722|LOG_ERR|LAYER3INTF|-|Error deleting egress object for port eth1, error: some_error", - "reason": "some_error" + "code": "1502", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1502|LOG_INFO|COPP|-|COPP initialization successful" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Error deleting egress object for port eth1, error: some_error", + "message": "COPP initialization successful", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:07:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "port": "eth1" + } }, "ecs": { "version": "8.11.0" @@ -4891,40 +4850,30 @@ "category": [ "network" ], - "code": "1723", - "original": "2024-06-18T13:07:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1723|LOG_INFO|LAYER3INTF|-|Deleted L3 egress ID 1001 for port eth1" + "code": "1503", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1503|LOG_ERR|COPP|-|Ingress FP Group create failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" - } - }, - "message": "Deleted L3 egress ID 1001 for port eth1", - "observer": { - "egress": { - "interface": { - "id": "1001" - } + "appname": "hpe-copp", + "procid": "1233" } }, + "message": "Ingress FP Group create failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:08:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -4934,36 +4883,30 @@ "category": [ "network" ], - "code": "1724", - "original": "2024-06-18T13:08:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1724|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with ipv4 address 192.168.1.1" + "code": "1504", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1504|LOG_ERR|COPP|-|Egress FP Group create failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, configured with ipv4 address 192.168.1.1", - "server": { - "ip": "192.168.1.1" - }, + "message": "Egress FP Group create failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:09:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -4973,36 +4916,33 @@ "category": [ "network" ], - "code": "1725", - "original": "2024-06-18T13:09:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1725|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with ipv6 address FE80::C000:1DFF:FEE0:C01/64" + "code": "1505", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1505|LOG_ERR|COPP|-|Programming defaults failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, configured with ipv6 address FE80::C000:1DFF:FEE0:C01/64", - "server": { - "ip": "FE80::C000:1DFF:FEE0:C01" - }, + "message": "Programming defaults failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:10:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" + }, + "copp": { + "class": "myClass" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -5012,36 +4952,33 @@ "category": [ "network" ], - "code": "1726", - "original": "2024-06-18T13:10:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1726|LOG_INFO|LAYER3INTF|-|Interface eth0, ipv4 address deleted 192.168.1.1" + "code": "1506", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1506|LOG_ERR|COPP|-|Packet class programming failed for myClass" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, ipv4 address deleted 192.168.1.1", - "server": { - "ip": "192.168.1.1" - }, + "message": "Packet class programming failed for myClass", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:11:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" + }, + "copp": { + "class": "myClass" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -5051,38 +4988,34 @@ "category": [ "network" ], - "code": "1727", - "original": "2024-06-18T13:11:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1727|LOG_INFO|LAYER3INTF|-|Interface eth0, ipv6 address deleted FE80::C000:1DFF:FEE0:C01/64" + "code": "1507", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1507|LOG_ERR|COPP|-|Failed to program ingress field processor rule for myClass" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, ipv6 address deleted FE80::C000:1DFF:FEE0:C01/64", - "server": { - "ip": "FE80::C000:1DFF:FEE0:C01" - }, + "message": "Failed to program ingress field processor rule for myClass", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:12:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" + }, + "copp": { + "class": "myClass" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" - }, - "status": "active" + } }, "ecs": { "version": "8.11.0" @@ -5091,37 +5024,32 @@ "category": [ "network" ], - "code": "1728", - "original": "2024-06-18T13:12:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1728|LOG_INFO|LAYER3INTF|-|IPv6 Address Status: Interface eth0, address 2001:db8:3333:4444:5555:6666:7777:8888, status active" + "code": "1508", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1508|LOG_ERR|COPP|-|Failed to program egress rule for myClass" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "IPv6 Address Status: Interface eth0, address 2001:db8:3333:4444:5555:6666:7777:8888, status active", - "server": { - "address": "2001:db8:3333:4444:5555:6666:7777:8888" - }, + "message": "Failed to program egress rule for myClass", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:13:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - } + "slot": 3 }, "ecs": { "version": "8.11.0" @@ -5130,37 +5058,32 @@ "category": [ "network" ], - "code": "1729", - "original": "2024-06-18T13:13:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1729|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with secondary ipv4 address 192.168.1.2" + "code": "1509", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1509|LOG_ERR|COPP|-|CoPP initial initialization failed on slot 3" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, configured with secondary ipv4 address 192.168.1.2", - "server": { - "ip": "192.168.1.2" - }, + "message": "CoPP initial initialization failed on slot 3", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:14:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - } + "slot": 3 }, "ecs": { "version": "8.11.0" @@ -5169,35 +5092,32 @@ "category": [ "network" ], - "code": "1730", - "original": "2024-06-18T13:14:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1730|LOG_INFO|LAYER3INTF|-|Interface eth0, secondary ipv4 address deleted 192.168.1.2" + "code": "1510", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1510|LOG_ERR|COPP|-|CoPP final initialization failed on slot 3" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Interface eth0, secondary ipv4 address deleted 192.168.1.2", - "server": { - "ip": "192.168.1.2" - }, + "message": "CoPP final initialization failed on slot 3", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:15:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "LAYER3INTF" + "category": "COPP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mtu": "1500" + "slot": 3 }, "ecs": { "version": "8.11.0" @@ -5206,35 +5126,35 @@ "category": [ "network" ], - "code": "1731", - "original": "2024-06-18T13:15:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1731|LOG_ERR|LAYER3INTF|-|IP MTU 1500 not applied due to hardware resource limitation" + "code": "1511", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1511|LOG_ERR|COPP|-|CoPP deinitialization failed on slot 3" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-l3interface", - "procid": "1234" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "IP MTU 1500 not applied due to hardware resource limitation", + "message": "CoPP deinitialization failed on slot 3", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T13:54:24.900661-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "ECMP" + "category": "COPP" }, - "ecmp": { - "err": "aruba_error", - "route": "aruba_route" + "copp": { + "class": "myClass" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "slot": 3 }, "ecs": { "version": "8.11.0" @@ -5243,34 +5163,35 @@ "category": [ "network" ], - "code": "1801", - "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1801|LOG_ERR|ECMP|-|Failed to update ecmp object for route aruba_route, error: aruba_error" + "code": "1512", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1512|LOG_ERR|COPP|-|Failed to configure hardware for CoPP on slot 3 class myClass" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-ecmpd", - "procid": "1980" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Failed to update ecmp object for route aruba_route, error: aruba_error", + "message": "Failed to configure hardware for CoPP on slot 3 class myClass", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T13:54:24.900661-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "ECMP" + "category": "COPP" }, - "ecmp": { - "route": "aruba_route" + "copp": { + "class": "myClass" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "slot": 3 }, "ecs": { "version": "8.11.0" @@ -5279,34 +5200,33 @@ "category": [ "network" ], - "code": "1802", - "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1802|LOG_INFO|ECMP|-|Update ecmp object for route aruba_route" + "code": "1513", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-copp[1233]: Event|1513|LOG_ERR|COPP|-|Failed to retrieve CoPP statistics from slot 3 class myClass" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-ecmpd", - "procid": "1980" + "appname": "hpe-copp", + "procid": "1233" } }, - "message": "Update ecmp object for route aruba_route", + "message": "Failed to retrieve CoPP statistics from slot 3 class myClass", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T13:54:24.900661-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "ECMP" - }, - "ecmp": { - "egressid": "aruba_egress_id", - "err": "aruba_error message" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -5316,33 +5236,33 @@ "category": [ "network" ], - "code": "1803", - "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1803|LOG_ERR|ECMP|-|Failed to delete ecmp egress object aruba_egress_id, error: aruba_error message" + "code": "1701", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1701|LOG_INFO|LAYER3INTF|-|L3-Interface eth0, created" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-ecmpd", - "procid": "1980" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "Failed to delete ecmp egress object aruba_egress_id, error: aruba_error message", + "message": "L3-Interface eth0, created", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T13:54:24.900661-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "ECMP" - }, - "ecmp": { - "egressid": "aruba_egress_id" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -5352,33 +5272,33 @@ "category": [ "network" ], - "code": "1804", - "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1804|LOG_INFO|ECMP|-|Delete ecmp egress object aruba_egress_id" + "code": "1702", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1702|LOG_INFO|LAYER3INTF|-|L3-Interface eth0, deleted" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ecmpd", - "procid": "1980" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "Delete ecmp egress object aruba_egress_id", + "message": "L3-Interface eth0, deleted", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T13:54:24.900661-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "ECMP" - }, - "ecmp": { - "err": "aruba_error message" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -5388,30 +5308,38 @@ "category": [ "network" ], - "code": "1805", - "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1805|LOG_ERR|ECMP|-|ECMP error: aruba_error message" + "code": "1704", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1704|LOG_ERR|LAYER3INTF|-|Failed to create 100 for layer 3 interface eth0" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-ecmpd", - "procid": "1980" + "appname": "hpe-l3interface", + "procid": "1234" + } + }, + "message": "Failed to create 100 for layer 3 interface eth0", + "network": { + "vlan": { + "id": "100" } }, - "message": "ECMP error: aruba_error message", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -5421,43 +5349,39 @@ "category": [ "network" ], - "code": "1901", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1901|LOG_INFO|DHCP|-|DHCP Lease added 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" - }, - "host": { - "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "code": "1705", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1705|LOG_ERR|LAYER3INTF|-|Failed to destroy layer 3 interface eth0 vlan 100, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" + } + }, + "message": "Failed to destroy layer 3 interface eth0 vlan 100, error: some_error", + "network": { + "vlan": { + "id": "100" } }, - "message": "DHCP Lease added 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -5467,39 +5391,27 @@ "category": [ "network" ], - "code": "1902", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1902|LOG_INFO|DHCP|-|DHCP Lease deleted 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" - }, - "host": { - "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "code": "1706", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1706|LOG_ERR|LAYER3INTF|-|Failed to delete an l3 interface eth0, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Lease deleted 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "message": "Failed to delete an l3 interface eth0, error: some_error", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { @@ -5513,39 +5425,32 @@ "category": [ "network" ], - "code": "1903", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1903|LOG_INFO|DHCP|-|DHCP Lease updated 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + "code": "1707", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1707|LOG_ERR|LAYER3INTF|-|Failed to add L3 host entry for ip 192.168.1.1, error: some_error", + "reason": "some_error" }, "host": { "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "192.168.1.1" + ] }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Lease updated 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "message": "Failed to add L3 host entry for ip 192.168.1.1, error: some_error", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { @@ -5559,39 +5464,31 @@ "category": [ "network" ], - "code": "1904", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1904|LOG_ERR|DHCP|-|DHCP Lease addition failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + "code": "1708", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1708|LOG_INFO|LAYER3INTF|-|Added L3 host entry for ip 192.168.1.1" }, "host": { "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "192.168.1.1" + ] }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Lease addition failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "message": "Added L3 host entry for ip 192.168.1.1", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { @@ -5605,39 +5502,32 @@ "category": [ "network" ], - "code": "1905", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1905|LOG_ERR|DHCP|-|DHCP Lease deletion failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + "code": "1709", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1709|LOG_ERR|LAYER3INTF|-|Failed to delete L3 host entry for ip 192.168.1.1, error: some_error", + "reason": "some_error" }, "host": { "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "192.168.1.1" + ] }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Lease deletion failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "message": "Failed to delete L3 host entry for ip 192.168.1.1, error: some_error", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { @@ -5651,46 +5541,35 @@ "category": [ "network" ], - "code": "1906", - "end": "01:23:45", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1906|LOG_ERR|DHCP|-|DHCP Lease update failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + "code": "1710", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1710|LOG_INFO|LAYER3INTF|-|Deleted L3 host entry for ip 192.168.1.1" }, "host": { "ip": [ - "10.1.2.3" - ], - "mac": [ - "1A-2B-3C-4D-5E-6F" - ], - "name": "myHost" + "192.168.1.1" + ] }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Lease update failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "message": "Deleted L3 host entry for ip 192.168.1.1", "tags": [ "preserve_original_event" - ], - "user": { - "id": "myClientId" - } + ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "vrf": { - "name": "myVrf" } }, "ecs": { @@ -5700,33 +5579,35 @@ "category": [ "network" ], - "code": "1907", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1907|LOG_INFO|DHCP|-|DHCP server enabled on VRF myVrf" + "code": "1711", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1711|LOG_ERR|LAYER3INTF|-|Failed to get L3 host hit for ip 192.168.1.1" + }, + "host": { + "ip": [ + "192.168.1.1" + ] }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP server enabled on VRF myVrf", + "message": "Failed to get L3 host hit for ip 192.168.1.1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "vrf": { - "name": "myVrf" } }, "ecs": { @@ -5736,37 +5617,36 @@ "category": [ "network" ], - "code": "1908", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1908|LOG_INFO|DHCP|-|DHCP server disabled on VRF myVrf" + "code": "1712", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1712|LOG_ERR|LAYER3INTF|-|L3 interface error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP server disabled on VRF myVrf", + "message": "L3 interface error: some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" - }, - "dhcp": { - "config": "myConfig" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "vrf": { - "name": "myVrf" - } + "l3": { + "nexthop": "192.168.1.2" + }, + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5775,34 +5655,42 @@ "category": [ "network" ], - "code": "1909", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1909|LOG_ERR|DHCP|-|Invalid DHCP configuration: myConfig provided on DHCP Server instance running on VRF myVrf. Ignoring this config." + "code": "1713", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1713|LOG_INFO|LAYER3INTF|-|Added Nexthop 192.168.1.2, egress_id 1001, for route 192.168.1.0/24" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" + } + }, + "message": "Added Nexthop 192.168.1.2, egress_id 1001, for route 192.168.1.0/24", + "observer": { + "egress": { + "interface": { + "id": "1001" + } } }, - "message": "Invalid DHCP configuration: myConfig provided on DHCP Server instance running on VRF myVrf. Ignoring this config.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:58:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "vrf": { - "name": "myVrf" - } + "l3": { + "nexthop": "192.168.1.2" + }, + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5811,34 +5699,32 @@ "category": [ "network" ], - "code": "1910", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1910|LOG_INFO|DHCP|-|DHCP Server Lease cleared on vrf myVrf." + "code": "1714", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1714|LOG_INFO|LAYER3INTF|-|Delete Nexthop 192.168.1.2 for route 192.168.1.0/24" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCP Server Lease cleared on vrf myVrf.", + "message": "Delete Nexthop 192.168.1.2 for route 192.168.1.0/24", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "@timestamp": "2024-06-18T12:59:38.182641-05:00", "aruba": { "component": { - "category": "DHCP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "vrf": { - "name": "myVrf" - } + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5847,31 +5733,32 @@ "category": [ "network" ], - "code": "1910", - "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1910|LOG_INFO|DHCP|-|DHCPv6 Server Lease cleared on vrf myVrf." + "code": "1715", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1715|LOG_INFO|LAYER3INTF|-|Added route 192.168.1.0/24" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "1979" + "appname": "hpe-l3interface", + "procid": "1234" } }, - "message": "DHCPv6 Server Lease cleared on vrf myVrf.", + "message": "Added route 192.168.1.0/24", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T13:00:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "state": "up" }, "ecs": { "version": "8.11.0" @@ -5880,31 +5767,32 @@ "category": [ "network" ], - "code": "2001", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2001|LOG_INFO|MSTP|-|MSTP Enabled" + "code": "1716", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1716|LOG_INFO|LAYER3INTF|-|Update: route state: up" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "MSTP Enabled", + "message": "Update: route state: up", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T13:01:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } + }, + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5913,35 +5801,32 @@ "category": [ "network" ], - "code": "2002", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2002|LOG_INFO|MSTP|-|MSTP Disabled" + "code": "1717", + "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1717|LOG_INFO|LAYER3INTF|-|Delete route 192.168.1.0/24" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "MSTP Disabled", + "message": "Delete route 192.168.1.0/24", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T13:02:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "config_parameter": "mstp_config", - "config_value": "enabled" - } + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5950,35 +5835,33 @@ "category": [ "network" ], - "code": "2003", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2003|LOG_WARN|MSTP|-|mstp_config should be enabled" + "code": "1718", + "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1718|LOG_ERR|LAYER3INTF|-|Delete route 192.168.1.0/24, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "mstp_config should be enabled", + "message": "Delete route 192.168.1.0/24, error: some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T13:03:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "config_parameter": "invalid_config", - "config_value": "eth0" - } + "prefix": "192.168.1.0/24" }, "ecs": { "version": "8.11.0" @@ -5987,34 +5870,33 @@ "category": [ "network" ], - "code": "2004", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2004|LOG_WARN|MSTP|-|BPDU has invalid_config from port eth0" + "code": "1719", + "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1719|LOG_ERR|LAYER3INTF|-|Add route 192.168.1.0/24, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "BPDU has invalid_config from port eth0", + "message": "Add route 192.168.1.0/24, error: some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T13:04:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "reconfig_parameter": "invalid_reconfig" - } + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -6023,35 +5905,36 @@ "category": [ "network" ], - "code": "2005", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2005|LOG_WARN|MSTP|-|Bad reconfiguration request: invalid_reconfig" + "code": "1720", + "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1720|LOG_ERR|LAYER3INTF|-|Error creating egress object for port eth1, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Bad reconfiguration request: invalid_reconfig", + "message": "Error creating egress object for port eth1, error: some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T13:05:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "proto": "MSTP" + "interface": { + "id": "eth0" }, - "port": "eth3" + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -6060,35 +5943,39 @@ "category": [ "network" ], - "code": "2009", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2009|LOG_INFO|MSTP|-|BPDU loss- port eth3 moved to inconsistent state for MSTP" + "code": "1721", + "original": "2024-06-18T13:05:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1721|LOG_INFO|LAYER3INTF|-|Created L3 egress ID 1001 for port eth1 intf eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "BPDU loss- port eth3 moved to inconsistent state for MSTP", + "message": "Created L3 egress ID 1001 for port eth1 intf eth0", + "observer": { + "egress": { + "interface": { + "id": "1001" + } + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T13:06:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "proto": "MSTP" - }, - "port": "eth4" + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -6097,35 +5984,33 @@ "category": [ "network" ], - "code": "2010", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2010|LOG_INFO|MSTP|-|Port eth4 moved out of inconsistent state for MSTP" + "code": "1722", + "original": "2024-06-18T13:06:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1722|LOG_ERR|LAYER3INTF|-|Error deleting egress object for port eth1, error: some_error", + "reason": "some_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Port eth4 moved out of inconsistent state for MSTP", + "message": "Error deleting egress object for port eth1, error: some_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T13:07:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" - }, - "port": "eth8" + "port": "eth1" }, "ecs": { "version": "8.11.0" @@ -6134,73 +6019,80 @@ "category": [ "network" ], - "code": "2016", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2016|LOG_INFO|MSTP|-|Port eth8 blocked on MST1" + "code": "1723", + "original": "2024-06-18T13:07:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1723|LOG_INFO|LAYER3INTF|-|Deleted L3 egress ID 1001 for port eth1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Port eth8 blocked on MST1", + "message": "Deleted L3 egress ID 1001 for port eth1", + "observer": { + "egress": { + "interface": { + "id": "1001" + } + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-18T13:08:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "1" - }, - "port": "eth9" - }, - "ecs": { + "interface": { + "id": "eth0" + } + }, + "ecs": { "version": "8.11.0" }, "event": { "category": [ "network" ], - "code": "2017", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2017|LOG_INFO|MSTP|-|Port eth9 unblocked on MST1" + "code": "1724", + "original": "2024-06-18T13:08:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1724|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with ipv4 address 192.168.1.1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Port eth9 unblocked on MST1", + "message": "Interface eth0, configured with ipv4 address 192.168.1.1", + "server": { + "ip": "192.168.1.1" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-18T13:09:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "old_port": "eth10", - "proto": "MSTP" - }, - "port": "eth11" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -6209,34 +6101,36 @@ "category": [ "network" ], - "code": "2018", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2018|LOG_INFO|MSTP|-|MSTP Root Port changed from eth10 to eth11" + "code": "1725", + "original": "2024-06-18T13:09:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1725|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with ipv6 address FE80::C000:1DFF:FEE0:C01/64" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "MSTP Root Port changed from eth10 to eth11", + "message": "Interface eth0, configured with ipv6 address FE80::C000:1DFF:FEE0:C01/64", + "server": { + "ip": "FE80::C000:1DFF:FEE0:C01" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "@timestamp": "2024-06-18T13:10:38.182641-05:00", "aruba": { "component": { - "category": "MSTP" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mstp": { - "new_mode": "MSTP", - "old_mode": "RSTP" + "interface": { + "id": "eth0" } }, "ecs": { @@ -6246,30 +6140,36 @@ "category": [ "network" ], - "code": "2019", - "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2019|LOG_INFO|MSTP|-|spanning tree mode changed from RSTP to MSTP, it will trigger the reconvergence" + "code": "1726", + "original": "2024-06-18T13:10:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1726|LOG_INFO|LAYER3INTF|-|Interface eth0, ipv4 address deleted 192.168.1.1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mstpd", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "spanning tree mode changed from RSTP to MSTP, it will trigger the reconvergence", + "message": "Interface eth0, ipv4 address deleted 192.168.1.1", + "server": { + "ip": "192.168.1.1" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T13:11:38.182641-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -6279,35 +6179,38 @@ "category": [ "network" ], - "code": "2201", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2201|LOG_INFO|REDUNDMGMT|-|Failover detected: Reason power_failure", - "reason": "power_failure" + "code": "1727", + "original": "2024-06-18T13:11:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1727|LOG_INFO|LAYER3INTF|-|Interface eth0, ipv6 address deleted FE80::C000:1DFF:FEE0:C01/64" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Failover detected: Reason power_failure", + "message": "Interface eth0, ipv6 address deleted FE80::C000:1DFF:FEE0:C01/64", + "server": { + "ip": "FE80::C000:1DFF:FEE0:C01" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T13:12:38.182641-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "redundant": { - "mgmt_module": "standby_module" - } + "interface": { + "id": "eth0" + }, + "status": "active" }, "ecs": { "version": "8.11.0" @@ -6316,30 +6219,36 @@ "category": [ "network" ], - "code": "2202", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2202|LOG_INFO|REDUNDMGMT|-|Lost standby_module as Standby Management Module, redundancy disabled" + "code": "1728", + "original": "2024-06-18T13:12:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1728|LOG_INFO|LAYER3INTF|-|IPv6 Address Status: Interface eth0, address 2001:db8:3333:4444:5555:6666:7777:8888, status active" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Lost standby_module as Standby Management Module, redundancy disabled", + "message": "IPv6 Address Status: Interface eth0, address 2001:db8:3333:4444:5555:6666:7777:8888, status active", + "server": { + "address": "2001:db8:3333:4444:5555:6666:7777:8888" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T13:13:38.182641-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" } }, "ecs": { @@ -6349,33 +6258,36 @@ "category": [ "network" ], - "code": "2203", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2203|LOG_INFO|REDUNDMGMT|-|Detected the removal of the Standby Management Module" + "code": "1729", + "original": "2024-06-18T13:13:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1729|LOG_INFO|LAYER3INTF|-|Interface eth0, configured with secondary ipv4 address 192.168.1.2" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "Detected the removal of the Standby Management Module", + "message": "Interface eth0, configured with secondary ipv4 address 192.168.1.2", + "server": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T13:14:38.182641-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "redundant": { - "mgmt_module": "active_module" + "interface": { + "id": "eth0" } }, "ecs": { @@ -6385,34 +6297,35 @@ "category": [ "network" ], - "code": "2204", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2204|LOG_INFO|REDUNDMGMT|-|active_module is Active" + "code": "1730", + "original": "2024-06-18T13:14:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1730|LOG_INFO|LAYER3INTF|-|Interface eth0, secondary ipv4 address deleted 192.168.1.2" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "active_module is Active", + "message": "Interface eth0, secondary ipv4 address deleted 192.168.1.2", + "server": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T13:15:38.182641-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "LAYER3INTF" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "redundant": { - "mgmt_module": "standby_module" - } + "mtu": "1500" }, "ecs": { "version": "8.11.0" @@ -6421,33 +6334,34 @@ "category": [ "network" ], - "code": "2205", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2205|LOG_INFO|REDUNDMGMT|-|standby_module is Standby" + "code": "1731", + "original": "2024-06-18T13:15:38.182641-05:00 8360-Primaire hpe-l3interface[1234]: Event|1731|LOG_ERR|LAYER3INTF|-|IP MTU 1500 not applied due to hardware resource limitation" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-rm", + "appname": "hpe-l3interface", "procid": "1234" } }, - "message": "standby_module is Standby", + "message": "IP MTU 1500 not applied due to hardware resource limitation", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-19T13:54:24.900661-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "ECMP" + }, + "ecmp": { + "err": "aruba_error", + "route": "aruba_route" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "redundant": { - "mgmt_module": "standby_module" } }, "ecs": { @@ -6457,26 +6371,29 @@ "category": [ "network" ], - "code": "2206", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2206|LOG_INFO|REDUNDMGMT|-|Detected standby_module as Standby Management Module, redundancy enabled" + "code": "1801", + "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1801|LOG_ERR|ECMP|-|Failed to update ecmp object for route aruba_route, error: aruba_error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-rm", - "procid": "1234" + "appname": "hpe-ecmpd", + "procid": "1980" } }, - "message": "Detected standby_module as Standby Management Module, redundancy enabled", + "message": "Failed to update ecmp object for route aruba_route, error: aruba_error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-19T13:54:24.900661-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "ECMP" + }, + "ecmp": { + "route": "aruba_route" }, "event_type": "Event", "hardware": { @@ -6490,33 +6407,34 @@ "category": [ "network" ], - "code": "2207", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2207|LOG_INFO|REDUNDMGMT|-|Remote Standby Management module recover detected. Reason: Heartbeat loss" + "code": "1802", + "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1802|LOG_INFO|ECMP|-|Update ecmp object for route aruba_route" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", - "procid": "1234" + "appname": "hpe-ecmpd", + "procid": "1980" } }, - "message": "Remote Standby Management module recover detected. Reason: Heartbeat loss", + "message": "Update ecmp object for route aruba_route", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-19T13:54:24.900661-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "ECMP" + }, + "ecmp": { + "egressid": "aruba_egress_id", + "err": "aruba_error message" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "redundant": { - "mgmt_module": "standby_module" } }, "ecs": { @@ -6526,33 +6444,33 @@ "category": [ "network" ], - "code": "2208", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2208|LOG_INFO|REDUNDMGMT|-|standby_module is waiting for filesync" + "code": "1803", + "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1803|LOG_ERR|ECMP|-|Failed to delete ecmp egress object aruba_egress_id, error: aruba_error message" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-rm", - "procid": "1234" + "appname": "hpe-ecmpd", + "procid": "1980" } }, - "message": "standby_module is waiting for filesync", + "message": "Failed to delete ecmp egress object aruba_egress_id, error: aruba_error message", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-19T13:54:24.900661-05:00", "aruba": { "component": { - "category": "REDUNDMGMT" + "category": "ECMP" + }, + "ecmp": { + "egressid": "aruba_egress_id" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "redundant": { - "mgmt_module": "standby_module" } }, "ecs": { @@ -6562,37 +6480,34 @@ "category": [ "network" ], - "code": "2209", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2209|LOG_INFO|REDUNDMGMT|-|standby_module is starting ISSU operation" + "code": "1804", + "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1804|LOG_INFO|ECMP|-|Delete ecmp egress object aruba_egress_id" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-rm", - "procid": "1234" + "appname": "hpe-ecmpd", + "procid": "1980" } }, - "message": "standby_module is starting ISSU operation", + "message": "Delete ecmp egress object aruba_egress_id", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025544-05:00", + "@timestamp": "2024-06-19T13:54:24.900661-05:00", "aruba": { - "aaa": { - "radius_action": "radius_action", - "radius_event": "radius_event", - "radius_type": "radius type" - }, "component": { - "category": "AMM" + "category": "ECMP" + }, + "ecmp": { + "err": "aruba_error message" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "sequence": "1/1" + } }, "ecs": { "version": "8.11.0" @@ -6601,9 +6516,3126 @@ "category": [ "network" ], - "code": "2303", - "original": "2024-06-19T14:22:07.025544-05:00 8360-Primaire acctd[358]: Event|2303|LOG_INFO|AMM|1/1|RADIUS radius type radius_action: radius_event", - "sequence": 1 + "code": "1805", + "original": "2024-06-19T13:54:24.900661-05:00 8360-Primaire hpe-ecmpd[1980]: Event|1805|LOG_ERR|ECMP|-|ECMP error: aruba_error message" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "hpe-ecmpd", + "procid": "1980" + } + }, + "message": "ECMP error: aruba_error message", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1901", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1901|LOG_INFO|DHCP|-|DHCP Lease added 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease added 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1902", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1902|LOG_INFO|DHCP|-|DHCP Lease deleted 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease deleted 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1903", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1903|LOG_INFO|DHCP|-|DHCP Lease updated 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease updated 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1904", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1904|LOG_ERR|DHCP|-|DHCP Lease addition failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease addition failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1905", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1905|LOG_ERR|DHCP|-|DHCP Lease deletion failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease deletion failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1906", + "end": "01:23:45", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1906|LOG_ERR|DHCP|-|DHCP Lease update failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId" + }, + "host": { + "ip": [ + "10.1.2.3" + ], + "mac": [ + "1A-2B-3C-4D-5E-6F" + ], + "name": "myHost" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Lease update failed 01:23:45 1a:2b:3c:4d:5e:6f 10.1.2.3 myHost myClientId", + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "myClientId" + } + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "myVrf" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1907", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1907|LOG_INFO|DHCP|-|DHCP server enabled on VRF myVrf" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP server enabled on VRF myVrf", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "myVrf" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1908", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1908|LOG_INFO|DHCP|-|DHCP server disabled on VRF myVrf" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP server disabled on VRF myVrf", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "dhcp": { + "config": "myConfig" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "myVrf" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1909", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1909|LOG_ERR|DHCP|-|Invalid DHCP configuration: myConfig provided on DHCP Server instance running on VRF myVrf. Ignoring this config." + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "Invalid DHCP configuration: myConfig provided on DHCP Server instance running on VRF myVrf. Ignoring this config.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "myVrf" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1910", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1910|LOG_INFO|DHCP|-|DHCP Server Lease cleared on vrf myVrf." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCP Server Lease cleared on vrf myVrf.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-07-22T19:59:24.900661-05:00", + "aruba": { + "component": { + "category": "DHCP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "myVrf" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "1910", + "original": "2024-07-22T19:59:24.900661-05:00 8360-Primaire dhcpd[1979]: Event|1910|LOG_INFO|DHCP|-|DHCPv6 Server Lease cleared on vrf myVrf." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "dhcpd", + "procid": "1979" + } + }, + "message": "DHCPv6 Server Lease cleared on vrf myVrf.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2001", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2001|LOG_INFO|MSTP|-|MSTP Enabled" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "MSTP Enabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2002", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2002|LOG_INFO|MSTP|-|MSTP Disabled" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "MSTP Disabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "config_parameter": "mstp_config", + "config_value": "enabled" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2003", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2003|LOG_WARN|MSTP|-|mstp_config should be enabled" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "mstp_config should be enabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "config_parameter": "invalid_config", + "config_value": "eth0" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2004", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2004|LOG_WARN|MSTP|-|BPDU has invalid_config from port eth0" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "BPDU has invalid_config from port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "reconfig_parameter": "invalid_reconfig" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2005", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2005|LOG_WARN|MSTP|-|Bad reconfiguration request: invalid_reconfig" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "Bad reconfiguration request: invalid_reconfig", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "proto": "MSTP" + }, + "port": "eth3" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2009", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2009|LOG_INFO|MSTP|-|BPDU loss- port eth3 moved to inconsistent state for MSTP" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "BPDU loss- port eth3 moved to inconsistent state for MSTP", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "proto": "MSTP" + }, + "port": "eth4" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2010", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2010|LOG_INFO|MSTP|-|Port eth4 moved out of inconsistent state for MSTP" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "Port eth4 moved out of inconsistent state for MSTP", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "1" + }, + "port": "eth8" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2016", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2016|LOG_INFO|MSTP|-|Port eth8 blocked on MST1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "Port eth8 blocked on MST1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "1" + }, + "port": "eth9" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2017", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2017|LOG_INFO|MSTP|-|Port eth9 unblocked on MST1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "Port eth9 unblocked on MST1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "old_port": "eth10", + "proto": "MSTP" + }, + "port": "eth11" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2018", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2018|LOG_INFO|MSTP|-|MSTP Root Port changed from eth10 to eth11" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "MSTP Root Port changed from eth10 to eth11", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "aruba": { + "component": { + "category": "MSTP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mstp": { + "new_mode": "MSTP", + "old_mode": "RSTP" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2019", + "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire mstpd[1234]: Event|2019|LOG_INFO|MSTP|-|spanning tree mode changed from RSTP to MSTP, it will trigger the reconvergence" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mstpd", + "procid": "1234" + } + }, + "message": "spanning tree mode changed from RSTP to MSTP, it will trigger the reconvergence", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2201", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2201|LOG_INFO|REDUNDMGMT|-|Failover detected: Reason power_failure", + "reason": "power_failure" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "Failover detected: Reason power_failure", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "standby_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2202", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2202|LOG_INFO|REDUNDMGMT|-|Lost standby_module as Standby Management Module, redundancy disabled" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "Lost standby_module as Standby Management Module, redundancy disabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2203", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2203|LOG_INFO|REDUNDMGMT|-|Detected the removal of the Standby Management Module" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "Detected the removal of the Standby Management Module", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "active_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2204", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2204|LOG_INFO|REDUNDMGMT|-|active_module is Active" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "active_module is Active", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "standby_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2205", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2205|LOG_INFO|REDUNDMGMT|-|standby_module is Standby" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "standby_module is Standby", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "standby_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2206", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2206|LOG_INFO|REDUNDMGMT|-|Detected standby_module as Standby Management Module, redundancy enabled" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "Detected standby_module as Standby Management Module, redundancy enabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2207", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2207|LOG_INFO|REDUNDMGMT|-|Remote Standby Management module recover detected. Reason: Heartbeat loss" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "Remote Standby Management module recover detected. Reason: Heartbeat loss", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "standby_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2208", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2208|LOG_INFO|REDUNDMGMT|-|standby_module is waiting for filesync" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "standby_module is waiting for filesync", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "aruba": { + "component": { + "category": "REDUNDMGMT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "redundant": { + "mgmt_module": "standby_module" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2209", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rm[1234]: Event|2209|LOG_INFO|REDUNDMGMT|-|standby_module is starting ISSU operation" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-rm", + "procid": "1234" + } + }, + "message": "standby_module is starting ISSU operation", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025544-05:00", + "aruba": { + "aaa": { + "radius_action": "radius_action", + "radius_event": "radius_event", + "radius_type": "radius type" + }, + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2303", + "original": "2024-06-19T14:22:07.025544-05:00 8360-Primaire acctd[358]: Event|2303|LOG_INFO|AMM|1/1|RADIUS radius type radius_action: radius_event", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "RADIUS radius type radius_action: radius_event", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025546-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "1/1/6", + "sequence": "1/1", + "status": "aruba_status", + "vrf": { + "id": "vpn-Internet" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2304", + "original": "2024-06-19T14:22:07.025546-05:00 8360-Primaire acctd[358]: Event|2304|LOG_INFO|AMM|1/1|RADIUS Server with Address: 127.0.0.1, Authport:1/1/6, VRF_ID:vpn-Internet is \"aruba_status\"", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "RADIUS Server with Address: 127.0.0.1, Authport:1/1/6, VRF_ID:vpn-Internet is \"aruba_status\"", + "server": { + "address": "127.0.0.1" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025547-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "1/1/6", + "sequence": "1/1", + "status": "aruba_status", + "vrf": { + "id": "vpn-Internet" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2305", + "original": "2024-06-19T14:22:07.025547-05:00 8360-Primaire acctd[358]: Event|2305|LOG_INFO|AMM|1/1|TACACS server host 127.0.0.1 port 1/1/6 vrf vpn-Internet aruba_status", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "TACACS server host 127.0.0.1 port 1/1/6 vrf vpn-Internet aruba_status", + "server": { + "address": "127.0.0.1" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "ospf": { + "area": "0.0.0.0", + "old_state": "INIT", + "router_id": "192.168.1.1" + }, + "state": "FULL" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2401", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2401|LOG_INFO|OSPFv2|-|AdjChg: Nbr 192.168.1.1 on eth0(0.0.0.0): INIT -> FULL" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "AdjChg: Nbr 192.168.1.1 on eth0(0.0.0.0): INIT -> FULL", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "ospf": { + "area": "0.0.0.0", + "input": "1", + "old_state": "DOWN" + }, + "state": "UP" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2402", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2402|LOG_INFO|OSPFv2|-|Interface eth0(0.0.0.0) changed from DOWN to UP, input: 1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "Interface eth0(0.0.0.0) changed from DOWN to UP, input: 1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "ospf": { + "event": "ROUTE_ADD", + "nexthops": "2" + } + }, + "destination": { + "address": "192.168.1.0/24" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2403", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2403|LOG_INFO|OSPFv2|-|ROUTE_ADD with 192.168.1.0/24 2" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "ROUTE_ADD with 192.168.1.0/24 2", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "ospf": { + "event": "KILL", + "old_state": "FULL", + "router_id": "192.168.1.1" + }, + "state": "DOWN" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2404", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2404|LOG_INFO|OSPFv2|-|AdjChg: Nbr 192.168.1.1 on eth0: FULL -> DOWN (KILL)" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "AdjChg: Nbr 192.168.1.1 on eth0: FULL -> DOWN (KILL)", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "ospf": { + "old_router_id": "1.1.1.1", + "router_id": "2.2.2.2" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2405", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2405|LOG_INFO|OSPFv2|-|Router-id updated from 1.1.1.1 to 2.2.2.2" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "Router-id updated from 1.1.1.1 to 2.2.2.2", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "install", + "category": [ + "network" + ], + "code": "2406", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2406|LOG_ERR|OSPFv2|-|Failed to install rule error: No space left on device", + "reason": "No space left on device" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "Failed to install rule error: No space left on device", + "rule": { + "name": "rule" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "ospf": { + "fp_id": "2", + "stats_id": "3" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2407", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2407|LOG_INFO|OSPFv2|-|OSPF all routers field entry added: group_id=1 fp_id=2 stat_id=3" + }, + "group": { + "id": "1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "OSPF all routers field entry added: group_id=1 fp_id=2 stat_id=3", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "OSPFv2" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "ospf": { + "fp_id": "2", + "stats_id": "3" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2408", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2408|LOG_INFO|OSPFv2|-|OSPF designated routers field entry added: group_id=1 fp_id=2 stat_id=3" + }, + "group": { + "id": "1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-ospf", + "procid": "1234" + } + }, + "message": "OSPF designated routers field entry added: group_id=1 fp_id=2 stat_id=3", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "pkt_type": "multicast" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2601", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2601|LOG_ERR|MGMD|-|Failed to alloc a multicast pkt(interface vlan10)" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Failed to alloc a multicast pkt(interface vlan10)", + "network": { + "vlan": { + "id": "vlan10" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2602", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2602|LOG_INFO|MGMD|-|Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv2." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv2.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "len": 1024, + "subsystem": "subsystem1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2603", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2603|LOG_ERR|MGMD|-|Unable to alloc a buf of size 1024 for subsystem1" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Unable to alloc a buf of size 1024 for subsystem1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "mgmd": { + "mgmd_type": "IGMP" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2604", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2604|LOG_INFO|MGMD|-|Interface eth0: Other Querier detected for IGMP" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Interface eth0: Other Querier detected for IGMP", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "mgmd": { + "mgmd_type": "IGMP" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2605", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2605|LOG_INFO|MGMD|-|IGMP Querier Election in progress for interface eth0 with IP address 192.168.1.1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP Querier Election in progress for interface eth0 with IP address 192.168.1.1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "mgmd": { + "mgmd_type": "IGMP" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2606", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2606|LOG_INFO|MGMD|-|Interface eth0: End IGMP Querier role" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Interface eth0: End IGMP Querier role", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "mgmd": { + "mgmd_type": "IGMP" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2607", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2607|LOG_INFO|MGMD|-|Interface eth0: Start IGMP Querier role addr: 192.168.1.1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Interface eth0: Start IGMP Querier role addr: 192.168.1.1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "mgmd_type": "11" + }, + "port": "8080" + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2608", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2608|LOG_WARN|MGMD|-|Received packet from 192.168.1.1, type 11, on invalid port 8080" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received packet from 192.168.1.1, type 11, on invalid port 8080", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2609", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2609|LOG_INFO|MGMD|-|Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv3." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv3.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2610", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2610|LOG_INFO|MGMD|-|Received IGMPv2 query from 192.168.1.1 when the device is configured for IGMPv3." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received IGMPv2 query from 192.168.1.1 when the device is configured for IGMPv3.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "mgmd_type": "IGMP" + }, + "status": "enabled" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2611", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2611|LOG_INFO|MGMD|-|IGMP snooping is enabled on VLAN 10." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP snooping is enabled on VLAN 10.", + "network": { + "vlan": { + "id": "" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "interface": { + "id": "eth0" + }, + "mgmd": { + "mgmd_type": "IGMP" + }, + "status": "enabled" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2612", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2612|LOG_INFO|MGMD|-|IGMP is enabled on Interface eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP is enabled on Interface eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "mgmd_type": "" + }, + "port": "eth0", + "status": "enabled" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2613", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2613|LOG_INFO|MGMD|-|Port eth0 on vlan 10 is set to enabled mode for IGMP." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Port eth0 on vlan 10 is set to enabled mode for IGMP.", + "network": { + "vlan": { + "id": "10" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "mgmd_type": "IGMP" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2614", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2614|LOG_ERR|MGMD|-|IGMP is not operational on VLAN 10 due to resource unavailability" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP is not operational on VLAN 10 due to resource unavailability", + "network": { + "vlan": { + "id": "10" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "l3_port": "eth0", + "mgmd_type": "IGMP" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2615", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2615|LOG_ERR|MGMD|-|IGMP is not operational on interface eth0 due to resource unavailability" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP is not operational on interface eth0 due to resource unavailability", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2616", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2616|LOG_INFO|MGMD|-|IGMP/MLD Resource utilization has exceeded the supported limits on the system. Membership reports for the new groups will be dropped." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP/MLD Resource utilization has exceeded the supported limits on the system. Membership reports for the new groups will be dropped.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2617", + "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2617|LOG_INFO|MGMD|-|IGMP/MLD Resource utilization has reached 90 percent of the supported limits on the system." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP/MLD Resource utilization has reached 90 percent of the supported limits on the system.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:02:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "mgmd_type": "IGMP" + }, + "status": "enabled" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2618", + "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2618|LOG_INFO|MGMD|-|IGMP snooping is enabled on VLAN 10." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "IGMP snooping is enabled on VLAN 10.", + "network": { + "vlan": { + "id": "10" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:03:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2619", + "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2619|LOG_INFO|MGMD|-|Received IGMPv3 query from 192.168.1.1 when the device is configured for IGMPv2." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received IGMPv3 query from 192.168.1.1 when the device is configured for IGMPv2.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:04:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2620", + "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2620|LOG_INFO|MGMD|-|Received MLDV1 query from 192.168.1.1 when the device is configured for MLDV2." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received MLDV1 query from 192.168.1.1 when the device is configured for MLDV2.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:05:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2621", + "original": "2024-06-18T13:05:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2621|LOG_INFO|MGMD|-|Received MLDV2 query from 192.168.1.1 when the device is configured for MLDV1." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Received MLDV2 query from 192.168.1.1 when the device is configured for MLDV1.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T13:06:38.182641-05:00", + "aruba": { + "component": { + "category": "MGMD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "mgmd": { + "port1": "eth1", + "ring_id": "1" + }, + "port": "eth0", + "state": "idle" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2622", + "original": "2024-06-18T13:06:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2622|LOG_INFO|MGMD|-|Flood mode is temporarily activated on ERPS ports eth0 and eth1 as ring state for ring id 1 changed to idle." + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "mgmd", + "procid": "1234" + } + }, + "message": "Flood mode is temporarily activated on ERPS ports eth0 and eth1 as ring state for ring id 1 changed to idle.", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "REPLICATIONMGR" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2701", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2701|LOG_WARN|REPLICATIONMGR|-|All bitmaps have been allocated" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "hpe-replication", + "procid": "1234" + } + }, + "message": "All bitmaps have been allocated", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "REPLICATIONMGR" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2702", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2702|LOG_WARN|REPLICATIONMGR|-|Over 80 percent of bitmaps have been allocated" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "hpe-replication", + "procid": "1234" + } + }, + "message": "Over 80 percent of bitmaps have been allocated", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "REPLICATIONMGR" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "123e4567-e89b-12d3-a456-426614174000" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2705", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2705|LOG_WARN|REPLICATIONMGR|-|Multicast L3 Bridge Control Forwarding entry with uuid 123e4567-e89b-12d3-a456-426614174000 has no reference to a VLAN" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "hpe-replication", + "procid": "1234" + } + }, + "message": "Multicast L3 Bridge Control Forwarding entry with uuid 123e4567-e89b-12d3-a456-426614174000 has no reference to a VLAN", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2801", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2801|LOG_WARN|LOOPPROTECT|-|Port eth0 is disabled by Loop-protection after loop detection on VLAN 10" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Port eth0 is disabled by Loop-protection after loop detection on VLAN 10", + "network": { + "vlan": { + "id": "10" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "loop": { + "rx_port": "eth2", + "tx_port": "eth1" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2802", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2802|LOG_WARN|LOOPPROTECT|-|Ports TX eth1 and RX eth2 are disabled by Loop-protect after loop detection on VLAN 20" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Ports TX eth1 and RX eth2 are disabled by Loop-protect after loop detection on VLAN 20", + "network": { + "vlan": { + "id": "20" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth3" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2803", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2803|LOG_WARN|LOOPPROTECT|-|Loop detected on port eth3 on VLAN 30" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Loop detected on port eth3 on VLAN 30", + "network": { + "vlan": { + "id": "30" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth4" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2804", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2804|LOG_INFO|LOOPPROTECT|-|Port eth4 enabled after disable time expired" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Port eth4 enabled after disable time expired", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth5" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2805", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2805|LOG_INFO|LOOPPROTECT|-|Port eth5 added for loop-protection" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Port eth5 added for loop-protection", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth6" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2806", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2806|LOG_INFO|LOOPPROTECT|-|Port eth6 deleted from loop-protection" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Port eth6 deleted from loop-protection", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth7" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2807", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2807|LOG_INFO|LOOPPROTECT|-|Loop-Protection stats cleared for port eth7" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Loop-Protection stats cleared for port eth7", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "LOOPPROTECT" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "loop": { + "rx_port": "eth9", + "tx_port": "eth8" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2808", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2808|LOG_INFO|LOOPPROTECT|-|Ports TX eth8 and RX eth9 are involved during TX port disabling" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "loopprotect", + "procid": "1234" + } + }, + "message": "Ports TX eth8 and RX eth9 are involved during TX port disabling", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "127.0.0.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2901", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2901|LOG_INFO|AMM|1/1|127.0.0.1: Peer up. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "127.0.0.1: Peer up. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2901", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2901|LOG_INFO|AMM|1/1|8360-ServerName: Peer up. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "8360-ServerName: Peer up. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "bgp": { + "error_subcode": "error_sub_code" + }, + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "127.0.0.1" + }, + "ecs": { + "version": "8.11.0" + }, + "error": { + "code": "error_code" + }, + "event": { + "category": [ + "network" + ], + "code": "2902", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2902|LOG_INFO|AMM|1/1|127.0.0.1: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "127.0.0.1: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "bgp": { + "error_subcode": "error_sub_code" + }, + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" + }, + "ecs": { + "version": "8.11.0" + }, + "error": { + "code": "error_code" + }, + "event": { + "category": [ + "network" + ], + "code": "2902", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2902|LOG_INFO|AMM|1/1|8360-ServerName: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "8360-ServerName: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2903", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2903|LOG_INFO|AMM|1/1|8360-ServerName: Peer has received prefix equal to Maximum Prefix value configured. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "8360-ServerName: Peer has received prefix equal to Maximum Prefix value configured. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "127.0.0.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2904", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2904|LOG_INFO|AMM|1/1|127.0.0.1: Peer has received prefix equal to Threshold value configured. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", @@ -6612,14 +9644,17 @@ "procid": "358" } }, - "message": "RADIUS radius type radius_action: radius_event", + "message": "127.0.0.1: Peer has received prefix equal to Threshold value configured. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025546-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { + "bgp": { + "as_number": 1234 + }, "component": { "category": "AMM" }, @@ -6627,11 +9662,9 @@ "hardware": { "device": "8360-Primaire" }, - "port": "1/1/6", "sequence": "1/1", - "status": "aruba_status", "vrf": { - "id": "vpn-Internet" + "name": "vpn-Internet" } }, "ecs": { @@ -6641,8 +9674,8 @@ "category": [ "network" ], - "code": "2304", - "original": "2024-06-19T14:22:07.025546-05:00 8360-Primaire acctd[358]: Event|2304|LOG_INFO|AMM|1/1|RADIUS Server with Address: 127.0.0.1, Authport:1/1/6, VRF_ID:vpn-Internet is \"aruba_status\"", + "code": "2905", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2905|LOG_INFO|AMM|1/1|BGP AS 1234 configured. vrf-name: vpn-Internet", "sequence": 1 }, "log": { @@ -6652,17 +9685,17 @@ "procid": "358" } }, - "message": "RADIUS Server with Address: 127.0.0.1, Authport:1/1/6, VRF_ID:vpn-Internet is \"aruba_status\"", - "server": { - "address": "127.0.0.1" - }, + "message": "BGP AS 1234 configured. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025547-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { + "bgp": { + "as_number": 1234 + }, "component": { "category": "AMM" }, @@ -6670,11 +9703,9 @@ "hardware": { "device": "8360-Primaire" }, - "port": "1/1/6", "sequence": "1/1", - "status": "aruba_status", "vrf": { - "id": "vpn-Internet" + "name": "vpn-Internet" } }, "ecs": { @@ -6684,8 +9715,8 @@ "category": [ "network" ], - "code": "2305", - "original": "2024-06-19T14:22:07.025547-05:00 8360-Primaire acctd[358]: Event|2305|LOG_INFO|AMM|1/1|TACACS server host 127.0.0.1 port 1/1/6 vrf vpn-Internet aruba_status", + "code": "2906", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2906|LOG_INFO|AMM|1/1|BGP AS 1234 unconfigured. vrf-name: vpn-Internet", "sequence": 1 }, "log": { @@ -6695,33 +9726,25 @@ "procid": "358" } }, - "message": "TACACS server host 127.0.0.1 port 1/1/6 vrf vpn-Internet aruba_status", - "server": { - "address": "127.0.0.1" - }, + "message": "BGP AS 1234 unconfigured. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - }, - "ospf": { - "area": "0.0.0.0", - "old_state": "INIT", - "router_id": "192.168.1.1" - }, - "state": "FULL" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } }, "ecs": { "version": "8.11.0" @@ -6730,40 +9753,83 @@ "category": [ "network" ], - "code": "2401", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2401|LOG_INFO|OSPFv2|-|AdjChg: Nbr 192.168.1.1 on eth0(0.0.0.0): INIT -> FULL" + "code": "2907", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2907|LOG_INFO|AMM|1/1|BGP router-id changed. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "AdjChg: Nbr 192.168.1.1 on eth0(0.0.0.0): INIT -> FULL", + "message": "BGP router-id changed. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "127.0.0.1", + "as": { + "number": 1 + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2908", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2908|LOG_INFO|AMM|1/1|127.0.0.1: Peer configured, AS 1. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "127.0.0.1: Peer configured, AS 1. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" }, - "ospf": { - "area": "0.0.0.0", - "input": "1", - "old_state": "DOWN" + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" }, - "state": "UP" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" }, "ecs": { "version": "8.11.0" @@ -6772,38 +9838,39 @@ "category": [ "network" ], - "code": "2402", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2402|LOG_INFO|OSPFv2|-|Interface eth0(0.0.0.0) changed from DOWN to UP, input: 1" + "code": "2909", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2909|LOG_INFO|AMM|1/1|8360-ServerName: User reset request. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Interface eth0(0.0.0.0) changed from DOWN to UP, input: 1", + "message": "8360-ServerName: User reset request. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "ospf": { - "event": "ROUTE_ADD", - "nexthops": "2" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" } }, "destination": { - "address": "192.168.1.0/24" + "address": "8360-ServerName" }, "ecs": { "version": "8.11.0" @@ -6812,40 +9879,80 @@ "category": [ "network" ], - "code": "2403", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2403|LOG_INFO|OSPFv2|-|ROUTE_ADD with 192.168.1.0/24 2" + "code": "2910", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2910|LOG_INFO|AMM|1/1|8360-ServerName: Peer password changed. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "ROUTE_ADD with 192.168.1.0/24 2", + "message": "8360-ServerName: Peer password changed. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "2911", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2911|LOG_INFO|AMM|1/1|8360-ServerName: Peer deleted. vrf-name: vpn-Internet", + "sequence": 1 + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "acctd", + "procid": "358" + } + }, + "message": "8360-ServerName: Peer deleted. vrf-name: vpn-Internet", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "aruba": { + "component": { + "category": "AMM" }, - "ospf": { - "event": "KILL", - "old_state": "FULL", - "router_id": "192.168.1.1" + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" }, - "state": "DOWN" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "8360-ServerName" }, "ecs": { "version": "8.11.0" @@ -6854,36 +9961,40 @@ "category": [ "network" ], - "code": "2404", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2404|LOG_INFO|OSPFv2|-|AdjChg: Nbr 192.168.1.1 on eth0: FULL -> DOWN (KILL)" + "code": "2912", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2912|LOG_INFO|AMM|1/1|8360-ServerName: Peer admin disabled. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "AdjChg: Nbr 192.168.1.1 on eth0: FULL -> DOWN (KILL)", + "message": "8360-ServerName: Peer admin disabled. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "ospf": { - "old_router_id": "1.1.1.1", - "router_id": "2.2.2.2" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" } }, + "destination": { + "address": "8360-ServerName" + }, "ecs": { "version": "8.11.0" }, @@ -6891,74 +10002,89 @@ "category": [ "network" ], - "code": "2405", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2405|LOG_INFO|OSPFv2|-|Router-id updated from 1.1.1.1 to 2.2.2.2" + "code": "2913", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2913|LOG_INFO|AMM|1/1|8360-ServerName: Peer admin enabled. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Router-id updated from 1.1.1.1 to 2.2.2.2", + "message": "8360-ServerName: Peer admin enabled. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "address": "127.0.0.1", + "as": { + "number": 1 } }, "ecs": { "version": "8.11.0" }, "event": { - "action": "install", "category": [ "network" ], - "code": "2406", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2406|LOG_ERR|OSPFv2|-|Failed to install rule error: No space left on device", - "reason": "No space left on device" + "code": "2914", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2914|LOG_INFO|AMM|1/1|127.0.0.1: Peer remote-as changed to 1. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Failed to install rule error: No space left on device", - "rule": { - "name": "rule" - }, + "message": "127.0.0.1: Peer remote-as changed to 1. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "ospf": { - "fp_id": "2", - "stats_id": "3" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "client": { + "as": { + "number": 1 } }, + "destination": { + "address": "127.0.0.1" + }, "ecs": { "version": "8.11.0" }, @@ -6966,39 +10092,40 @@ "category": [ "network" ], - "code": "2407", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2407|LOG_INFO|OSPFv2|-|OSPF all routers field entry added: group_id=1 fp_id=2 stat_id=3" - }, - "group": { - "id": "1" + "code": "2915", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2915|LOG_INFO|AMM|1/1|127.0.0.1: Peer local-as changed to 1. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "OSPF all routers field entry added: group_id=1 fp_id=2 stat_id=3", + "message": "127.0.0.1: Peer local-as changed to 1. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "OSPFv2" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "ospf": { - "fp_id": "2", - "stats_id": "3" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" } }, + "destination": { + "address": "8360-ServerName" + }, "ecs": { "version": "8.11.0" }, @@ -7006,38 +10133,43 @@ "category": [ "network" ], - "code": "2408", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-ospf[1234]: Event|2408|LOG_INFO|OSPFv2|-|OSPF designated routers field entry added: group_id=1 fp_id=2 stat_id=3" - }, - "group": { - "id": "1" + "code": "2916", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2916|LOG_INFO|AMM|1/1|8360-ServerName: Peer source-address changed to 127.0.0.1. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ospf", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "OSPF designated routers field entry added: group_id=1 fp_id=2 stat_id=3", + "message": "8360-ServerName: Peer source-address changed to 127.0.0.1. vrf-name: vpn-Internet", + "source": { + "ip": "127.0.0.1" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmd": { - "pkt_type": "multicast" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" } }, + "destination": { + "address": "8360-ServerName" + }, "ecs": { "version": "8.11.0" }, @@ -7045,39 +10177,42 @@ "category": [ "network" ], - "code": "2601", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2601|LOG_ERR|MGMD|-|Failed to alloc a multicast pkt(interface vlan10)" + "code": "2917", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2917|LOG_INFO|AMM|1/1|8360-ServerName: Peer remove-private-as configuration changed. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "mgmd", - "procid": "1234" - } - }, - "message": "Failed to alloc a multicast pkt(interface vlan10)", - "network": { - "vlan": { - "id": "vlan10" + "appname": "acctd", + "procid": "358" } }, + "message": "8360-ServerName: Peer remove-private-as configuration changed. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { + "bgp": { + "id": "1234" + }, "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" } }, - "client": { - "ip": "192.168.1.1" + "destination": { + "address": "127.0.0.1" }, "ecs": { "version": "8.11.0" @@ -7086,33 +10221,39 @@ "category": [ "network" ], - "code": "2602", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2602|LOG_INFO|MGMD|-|Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv2." + "code": "2918", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2918|LOG_INFO|AMM|1/1|1234: BGP identifier sent by Peer 127.0.0.1 matches ours. BGP session may not established. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv2.", + "message": "1234: BGP identifier sent by Peer 127.0.0.1 matches ours. BGP session may not established. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "len": 1024, - "subsystem": "subsystem1" + "limit": { + "threshold": "10" + }, + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } }, "ecs": { "version": "8.11.0" @@ -7121,36 +10262,43 @@ "category": [ "network" ], - "code": "2603", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2603|LOG_ERR|MGMD|-|Unable to alloc a buf of size 1024 for subsystem1" + "code": "2919", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2919|LOG_CRIT|AMM|1/1|The BGP RIB has reached the threshold limit of 10 for VRF vpn-Internet': yes", + "sequence": 1 }, "log": { - "level": "LOG_ERR", + "level": "LOG_CRIT", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Unable to alloc a buf of size 1024 for subsystem1", + "message": "The BGP RIB has reached the threshold limit of 10 for VRF vpn-Internet': yes", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { + "bgp": { + "pg_name": "pg_name" + }, "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" - }, - "mgmd": { - "mgmd_type": "IGMP" + "sequence": "1/1", + "vrf": { + "name": "vpn-Internet" + } + }, + "destination": { + "as": { + "number": 10 } }, "ecs": { @@ -7160,270 +10308,274 @@ "category": [ "network" ], - "code": "2604", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2604|LOG_INFO|MGMD|-|Interface eth0: Other Querier detected for IGMP" + "code": "2920", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2920|LOG_INFO|AMM|1/1|pg_name: Peer-group configured with remote-as 10. vrf-name: vpn-Internet", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Interface eth0: Other Querier detected for IGMP", + "message": "pg_name: Peer-group configured with remote-as 10. vrf-name: vpn-Internet", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" + "device": "8360-Primaire", + "test_name": "mock_test_name" }, - "mgmd": { - "mgmd_type": "IGMP" - } - }, - "client": { - "ip": "192.168.1.1" + "sequence": "1/1", + "slot": 1 }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2605", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2605|LOG_INFO|MGMD|-|IGMP Querier Election in progress for interface eth0 with IP address 192.168.1.1" + "code": "3001", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3001|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on management module 1", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "IGMP Querier Election in progress for interface eth0 with IP address 192.168.1.1", + "message": "Diagnostic mock_test_name failed with error code mock_error_code on management module 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" + "device": "8360-Primaire", + "test_name": "mock_test_name" }, - "mgmd": { - "mgmd_type": "IGMP" - } + "sequence": "1/1", + "slot": 2 }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2606", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2606|LOG_INFO|MGMD|-|Interface eth0: End IGMP Querier role" + "code": "3002", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3002|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on line card 2", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Interface eth0: End IGMP Querier role", + "message": "Diagnostic mock_test_name failed with error code mock_error_code on line card 2", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" + "device": "8360-Primaire", + "test_name": "mock_test_name" }, - "mgmd": { - "mgmd_type": "IGMP" - } - }, - "client": { - "ip": "192.168.1.1" + "sequence": "1/1", + "slot": 3 }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2607", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2607|LOG_INFO|MGMD|-|Interface eth0: Start IGMP Querier role addr: 192.168.1.1" + "code": "3003", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3003|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on fabric card 3", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Interface eth0: Start IGMP Querier role addr: 192.168.1.1", + "message": "Diagnostic mock_test_name failed with error code mock_error_code on fabric card 3", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "mgmd": { - "mgmd_type": "11" + "device": "8360-Primaire", + "test_name": "mock_test_name" }, - "port": "8080" - }, - "client": { - "ip": "192.168.1.1" + "sequence": "1/1", + "slot": 4 }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2608", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2608|LOG_WARN|MGMD|-|Received packet from 192.168.1.1, type 11, on invalid port 8080" + "code": "3004", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3004|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on fan tray 4", + "sequence": 1 }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Received packet from 192.168.1.1, type 11, on invalid port 8080", + "message": "Diagnostic mock_test_name failed with error code mock_error_code on fan tray 4", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - } - }, - "client": { - "ip": "192.168.1.1" + "device": "8360-Primaire", + "test_name": "mock_test_name" + }, + "sequence": "1/1", + "slot": 5 }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2609", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2609|LOG_INFO|MGMD|-|Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv3." + "code": "3005", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3005|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on rear display card 5", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Received IGMPv1 query from 192.168.1.1 when the device is configured for IGMPv3.", + "message": "Diagnostic mock_test_name failed with error code mock_error_code on rear display card 5", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - } - }, - "client": { - "ip": "192.168.1.1" + "device": "8360-Primaire", + "test_name": "mock_test_name" + }, + "sequence": "1/1" }, "ecs": { "version": "8.11.0" }, + "error": { + "code": "mock_error_code" + }, "event": { "category": [ "network" ], - "code": "2610", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2610|LOG_INFO|MGMD|-|Received IGMPv2 query from 192.168.1.1 when the device is configured for IGMPv3." + "code": "3006", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3006|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code for the system", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "Received IGMPv2 query from 192.168.1.1 when the device is configured for IGMPv3.", + "message": "Diagnostic mock_test_name failed with error code mock_error_code for the system", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "mgmd": { - "mgmd_type": "IGMP" + "device": "8360-Primaire", + "location": "mock_location", + "origin": "mock_origin" }, - "status": "enabled" + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7432,43 +10584,37 @@ "category": [ "network" ], - "code": "2611", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2611|LOG_INFO|MGMD|-|IGMP snooping is enabled on VLAN 10." + "code": "3007", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3007|LOG_WARN|AMM|1/1|There are mock_origin happening on mock_location", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" - } - }, - "message": "IGMP snooping is enabled on VLAN 10.", - "network": { - "vlan": { - "id": "" + "appname": "acctd", + "procid": "358" } }, + "message": "There are mock_origin happening on mock_location", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" - }, - "mgmd": { - "mgmd_type": "IGMP" + "bus": "mock_bus", + "device": "mock_device", + "function": "mock_function", + "location": "mock_location", + "seg": "mock_seg" }, - "status": "enabled" + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7477,36 +10623,39 @@ "category": [ "network" ], - "code": "2612", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2612|LOG_INFO|MGMD|-|IGMP is enabled on Interface eth0" + "code": "3008", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3008|LOG_WARN|AMM|1/1|There are IO errors on mock_location from mock_seg:mock_bus:mock_device:mock_function", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "IGMP is enabled on Interface eth0", + "message": "There are IO errors on mock_location from mock_seg:mock_bus:mock_device:mock_function", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - }, - "mgmd": { - "mgmd_type": "" + "addr": "mock_addr", + "cap": "mock_cap", + "device": "8360-Primaire", + "location": "mock_location", + "mcgstatus": "mock_mcgstatus", + "misc": "mock_misc" }, - "port": "eth0", - "status": "enabled" + "sequence": "1/1", + "status": "mock_status" }, "ecs": { "version": "8.11.0" @@ -7515,39 +10664,37 @@ "category": [ "network" ], - "code": "2613", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2613|LOG_INFO|MGMD|-|Port eth0 on vlan 10 is set to enabled mode for IGMP." + "code": "3009", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3009|LOG_INFO|AMM|1/1|There are unknown errors on mock_location from mock_status:mock_addr:mock_misc:mock_mcgstatus:mock_cap", + "sequence": 1 }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", - "procid": "1234" - } - }, - "message": "Port eth0 on vlan 10 is set to enabled mode for IGMP.", - "network": { - "vlan": { - "id": "10" + "appname": "acctd", + "procid": "358" } }, + "message": "There are unknown errors on mock_location from mock_status:mock_addr:mock_misc:mock_mcgstatus:mock_cap", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" + "cpus": 2, + "device": "8360-Primaire", + "level": "mock_level", + "offlined": 1, + "type": "mock_type" }, - "mgmd": { - "mgmd_type": "IGMP" - } + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7556,40 +10703,38 @@ "category": [ "network" ], - "code": "2614", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2614|LOG_ERR|MGMD|-|IGMP is not operational on VLAN 10 due to resource unavailability" + "code": "3010", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3010|LOG_WARN|AMM|1/1|CPUs 2 Lmock_level mock_type cache error detected. CPUs 1 offlined", + "sequence": 1 }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" - } - }, - "message": "IGMP is not operational on VLAN 10 due to resource unavailability", - "network": { - "vlan": { - "id": "10" + "appname": "acctd", + "procid": "358" } }, + "message": "CPUs 2 Lmock_level mock_type cache error detected. CPUs 1 offlined", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" + "cecount": 1, + "device": "8360-Primaire", + "socket": "mock_socket" }, - "mgmd": { - "l3_port": "eth0", - "mgmd_type": "IGMP" - } + "limit": { + "threshold": "1" + }, + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7598,31 +10743,38 @@ "category": [ "network" ], - "code": "2615", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2615|LOG_ERR|MGMD|-|IGMP is not operational on interface eth0 due to resource unavailability" + "code": "3011", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3011|LOG_WARN|AMM|1/1|Socket mock_socket correctable memory error count 1 exceeded threshold 1", + "sequence": 1 }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "IGMP is not operational on interface eth0 due to resource unavailability", + "message": "Socket mock_socket correctable memory error count 1 exceeded threshold 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { + "cecount": 2, + "channel": "mock_channel", "device": "8360-Primaire" - } + }, + "limit": { + "threshold": "1" + }, + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7631,31 +10783,39 @@ "category": [ "network" ], - "code": "2616", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2616|LOG_INFO|MGMD|-|IGMP/MLD Resource utilization has exceeded the supported limits on the system. Membership reports for the new groups will be dropped." + "code": "3012", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3012|LOG_WARN|AMM|1/1|Module mock_channel correctable memory error count 2 exceeded threshold 1", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "IGMP/MLD Resource utilization has exceeded the supported limits on the system. Membership reports for the new groups will be dropped.", + "message": "Module mock_channel correctable memory error count 2 exceeded threshold 1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "@timestamp": "2024-06-19T14:22:07.025548-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "AMM" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire" - } + "cecount": 2, + "device": "8360-Primaire", + "offlined": 3, + "page": "mock_page" + }, + "limit": { + "threshold": "1" + }, + "sequence": "1/1" }, "ecs": { "version": "8.11.0" @@ -7664,35 +10824,33 @@ "category": [ "network" ], - "code": "2617", - "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2617|LOG_INFO|MGMD|-|IGMP/MLD Resource utilization has reached 90 percent of the supported limits on the system." + "code": "3013", + "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3013|LOG_WARN|AMM|1/1|Page mock_page correctable memory error count 2 exceeded threshold 1 and 3", + "sequence": 1 }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "mgmd", - "procid": "1234" + "appname": "acctd", + "procid": "358" } }, - "message": "IGMP/MLD Resource utilization has reached 90 percent of the supported limits on the system.", + "message": "Page mock_page correctable memory error count 2 exceeded threshold 1 and 3", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:02:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "MVRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmd": { - "mgmd_type": "IGMP" - }, - "status": "enabled" + "port": "eth0" }, "ecs": { "version": "8.11.0" @@ -7701,39 +10859,32 @@ "category": [ "network" ], - "code": "2618", - "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2618|LOG_INFO|MGMD|-|IGMP snooping is enabled on VLAN 10." + "code": "3101", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3101|LOG_INFO|MVRP|-|MVRP enabled on port eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", + "appname": "hpe-mvrp", "procid": "1234" } }, - "message": "IGMP snooping is enabled on VLAN 10.", - "network": { - "vlan": { - "id": "10" - } - }, + "message": "MVRP enabled on port eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:03:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "MVRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } - }, - "client": { - "ip": "192.168.1.1" + }, + "port": "eth0" }, "ecs": { "version": "8.11.0" @@ -7742,35 +10893,35 @@ "category": [ "network" ], - "code": "2619", - "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2619|LOG_INFO|MGMD|-|Received IGMPv3 query from 192.168.1.1 when the device is configured for IGMPv2." + "code": "3102", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3102|LOG_INFO|MVRP|-|MVRP disabled on port eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", + "appname": "hpe-mvrp", "procid": "1234" } }, - "message": "Received IGMPv3 query from 192.168.1.1 when the device is configured for IGMPv2.", + "message": "MVRP disabled on port eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:04:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "MVRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "limit": { + "threshold": "50" } }, - "client": { - "ip": "192.168.1.1" - }, "ecs": { "version": "8.11.0" }, @@ -7778,34 +10929,37 @@ "category": [ "network" ], - "code": "2620", - "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2620|LOG_INFO|MGMD|-|Received MLDV1 query from 192.168.1.1 when the device is configured for MLDV2." + "code": "3103", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3103|LOG_ERR|MVRP|-|MVRP failed to create VLAN 100. Maximum VLANs 50 already created throttle_count: 100" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "mgmd", + "appname": "hpe-mvrp", "procid": "1234" } }, - "message": "Received MLDV1 query from 192.168.1.1 when the device is configured for MLDV2.", + "message": "MVRP failed to create VLAN 100. Maximum VLANs 50 already created throttle_count: 100", + "network": { + "vlan": { + "id": "100" + } + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:05:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "MVRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - } - }, - "client": { - "ip": "192.168.1.1" + }, + "port": "eth0" }, "ecs": { "version": "8.11.0" @@ -7814,37 +10968,32 @@ "category": [ "network" ], - "code": "2621", - "original": "2024-06-18T13:05:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2621|LOG_INFO|MGMD|-|Received MLDV2 query from 192.168.1.1 when the device is configured for MLDV1." + "code": "3104", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3104|LOG_INFO|MVRP|-|MVRP statistics have been cleared for port eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", + "appname": "hpe-mvrp", "procid": "1234" } }, - "message": "Received MLDV2 query from 192.168.1.1 when the device is configured for MLDV1.", + "message": "MVRP statistics have been cleared for port eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:06:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "MGMD" + "category": "MVRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmd": { - "port1": "eth1", - "ring_id": "1" - }, - "port": "eth0", - "state": "idle" + "port": "5" }, "ecs": { "version": "8.11.0" @@ -7853,17 +11002,17 @@ "category": [ "network" ], - "code": "2622", - "original": "2024-06-18T13:06:38.182641-05:00 8360-Primaire mgmd[1234]: Event|2622|LOG_INFO|MGMD|-|Flood mode is temporarily activated on ERPS ports eth0 and eth1 as ring state for ring id 1 changed to idle." + "code": "3105", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3105|LOG_INFO|MVRP|-|MVRP statistics have been cleared for 5 ports" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "mgmd", + "appname": "hpe-mvrp", "procid": "1234" } }, - "message": "Flood mode is temporarily activated on ERPS ports eth0 and eth1 as ring state for ring id 1 changed to idle.", + "message": "MVRP statistics have been cleared for 5 ports", "tags": [ "preserve_original_event" ] @@ -7872,11 +11021,15 @@ "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "REPLICATIONMGR" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -7886,17 +11039,17 @@ "category": [ "network" ], - "code": "2701", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2701|LOG_WARN|REPLICATIONMGR|-|All bitmaps have been allocated" + "code": "3201", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3201|LOG_INFO|Module|-|Ethernet module eth0 inserted" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-replication", + "appname": "hpe-module", "procid": "1234" } }, - "message": "All bitmaps have been allocated", + "message": "Ethernet module eth0 inserted", "tags": [ "preserve_original_event" ] @@ -7905,11 +11058,15 @@ "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "REPLICATIONMGR" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -7919,17 +11076,17 @@ "category": [ "network" ], - "code": "2702", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2702|LOG_WARN|REPLICATIONMGR|-|Over 80 percent of bitmaps have been allocated" + "code": "3202", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3202|LOG_WARN|Module|-|Ethernet module eth0 removed" }, "log": { "level": "LOG_WARN", "syslog": { - "appname": "hpe-replication", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Over 80 percent of bitmaps have been allocated", + "message": "Ethernet module eth0 removed", "tags": [ "preserve_original_event" ] @@ -7938,14 +11095,15 @@ "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "REPLICATIONMGR" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "instance": { - "id": "123e4567-e89b-12d3-a456-426614174000" + "module": { + "name": "eth0", + "type": "Initiating Ethernet" } }, "ecs": { @@ -7955,32 +11113,35 @@ "category": [ "network" ], - "code": "2705", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-replication[1234]: Event|2705|LOG_WARN|REPLICATIONMGR|-|Multicast L3 Bridge Control Forwarding entry with uuid 123e4567-e89b-12d3-a456-426614174000 has no reference to a VLAN" + "code": "3203", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3203|LOG_INFO|Module|-|Initiating Ethernet module eth0 reboot" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-replication", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Multicast L3 Bridge Control Forwarding entry with uuid 123e4567-e89b-12d3-a456-426614174000 has no reference to a VLAN", + "message": "Initiating Ethernet module eth0 reboot", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -7989,39 +11150,34 @@ "category": [ "network" ], - "code": "2801", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2801|LOG_WARN|LOOPPROTECT|-|Port eth0 is disabled by Loop-protection after loop detection on VLAN 10" + "code": "3204", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3204|LOG_INFO|Module|-|Ethernet module eth0 is ready" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Port eth0 is disabled by Loop-protection after loop detection on VLAN 10", - "network": { - "vlan": { - "id": "10" - } - }, + "message": "Ethernet module eth0 is ready", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "loop": { - "rx_port": "eth2", - "tx_port": "eth1" + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8031,37 +11187,36 @@ "category": [ "network" ], - "code": "2802", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2802|LOG_WARN|LOOPPROTECT|-|Ports TX eth1 and RX eth2 are disabled by Loop-protect after loop detection on VLAN 20" + "code": "3205", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3205|LOG_INFO|Module|-|Ethernet module eth0 is down: hardware failure", + "reason": "hardware failure" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Ports TX eth1 and RX eth2 are disabled by Loop-protect after loop detection on VLAN 20", - "network": { - "vlan": { - "id": "20" - } - }, + "message": "Ethernet module eth0 is down: hardware failure", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth3" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -8070,37 +11225,35 @@ "category": [ "network" ], - "code": "2803", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2803|LOG_WARN|LOOPPROTECT|-|Loop detected on port eth3 on VLAN 30" + "code": "3206", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3206|LOG_INFO|Module|-|Ethernet module eth0 is in diagnostics mode" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Loop detected on port eth3 on VLAN 30", - "network": { - "vlan": { - "id": "30" - } - }, + "message": "Ethernet module eth0 is in diagnostics mode", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth4" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -8109,32 +11262,36 @@ "category": [ "network" ], - "code": "2804", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2804|LOG_INFO|LOOPPROTECT|-|Port eth4 enabled after disable time expired" + "code": "3207", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3207|LOG_ERR|Module|-|Ethernet module eth0 has failed: hardware failure", + "reason": "hardware failure" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Port eth4 enabled after disable time expired", + "message": "Ethernet module eth0 has failed: hardware failure", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth5" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -8143,32 +11300,35 @@ "category": [ "network" ], - "code": "2805", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2805|LOG_INFO|LOOPPROTECT|-|Port eth5 added for loop-protection" + "code": "3208", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3208|LOG_INFO|Module|-|Ethernet module eth0 admin state set to up" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Port eth5 added for loop-protection", + "message": "Ethernet module eth0 admin state set to up", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth6" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -8177,32 +11337,35 @@ "category": [ "network" ], - "code": "2806", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2806|LOG_INFO|LOOPPROTECT|-|Port eth6 deleted from loop-protection" + "code": "3209", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3209|LOG_INFO|Module|-|Ethernet module eth0 admin state set to down" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Port eth6 deleted from loop-protection", + "message": "Ethernet module eth0 admin state set to down", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth7" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -8211,34 +11374,34 @@ "category": [ "network" ], - "code": "2807", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2807|LOG_INFO|LOOPPROTECT|-|Loop-Protection stats cleared for port eth7" + "code": "3210", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3210|LOG_INFO|Module|-|Ethernet module eth0 admin state set to diagnostics" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Loop-Protection stats cleared for port eth7", + "message": "Ethernet module eth0 admin state set to diagnostics", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "LOOPPROTECT" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "loop": { - "rx_port": "eth9", - "tx_port": "eth8" + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8248,39 +11411,36 @@ "category": [ "network" ], - "code": "2808", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire loopprotect[1234]: Event|2808|LOG_INFO|LOOPPROTECT|-|Ports TX eth8 and RX eth9 are involved during TX port disabling" + "code": "3211", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3211|LOG_INFO|Module|-|Ethernet module eth0 ISP passed" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "loopprotect", + "appname": "hpe-module", "procid": "1234" } }, - "message": "Ports TX eth8 and RX eth9 are involved during TX port disabling", + "message": "Ethernet module eth0 ISP passed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "127.0.0.1" - }, "ecs": { "version": "8.11.0" }, @@ -8288,40 +11448,36 @@ "category": [ "network" ], - "code": "2901", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2901|LOG_INFO|AMM|1/1|127.0.0.1: Peer up. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3212", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3212|LOG_ERR|Module|-|Ethernet module eth0 ISP failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer up. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ISP failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8329,134 +11485,111 @@ "category": [ "network" ], - "code": "2901", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2901|LOG_INFO|AMM|1/1|8360-ServerName: Peer up. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3213", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3213|LOG_WARN|Module|-|Ethernet module eth0 ISP skipped" }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer up. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ISP skipped", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:58:38.182641-05:00", "aruba": { - "bgp": { - "error_subcode": "error_sub_code" - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "127.0.0.1" - }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "error_code" - }, "event": { "category": [ "network" ], - "code": "2902", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2902|LOG_INFO|AMM|1/1|127.0.0.1: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3214", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3214|LOG_INFO|Module|-|Ethernet module eth0 has enabled standby power" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 has enabled standby power", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:59:38.182641-05:00", "aruba": { - "bgp": { - "error_subcode": "error_sub_code" - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" - } - }, - "destination": { - "address": "8360-ServerName" + "module": { + "name": "eth0", + "type": "Ethernet" + }, + "priority": "high" }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "error_code" - }, "event": { "category": [ "network" ], - "code": "2902", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2902|LOG_INFO|AMM|1/1|8360-ServerName: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3215", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3215|LOG_INFO|Module|-|Ethernet module eth0 is requesting to power on with priority high" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer down. error-code: error_code, error-sub-code: error_sub_code. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 is requesting to power on with priority high", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:00:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8464,40 +11597,36 @@ "category": [ "network" ], - "code": "2903", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2903|LOG_INFO|AMM|1/1|8360-ServerName: Peer has received prefix equal to Maximum Prefix value configured. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3216", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3216|LOG_INFO|Module|-|Ethernet module eth0 power request has been granted" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer has received prefix equal to Maximum Prefix value configured. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 power request has been granted", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:01:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "127.0.0.1" - }, "ecs": { "version": "8.11.0" }, @@ -8505,38 +11634,34 @@ "category": [ "network" ], - "code": "2904", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2904|LOG_INFO|AMM|1/1|127.0.0.1: Peer has received prefix equal to Threshold value configured. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3217", + "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3217|LOG_ERR|Module|-|Ethernet module eth0 power request has been denied" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer has received prefix equal to Threshold value configured. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 power request has been denied", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:02:38.182641-05:00", "aruba": { - "bgp": { - "as_number": 1234 - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8546,38 +11671,34 @@ "category": [ "network" ], - "code": "2905", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2905|LOG_INFO|AMM|1/1|BGP AS 1234 configured. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3218", + "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3218|LOG_INFO|Module|-|Ethernet module eth0 enabling main power" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "BGP AS 1234 configured. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 enabling main power", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:03:38.182641-05:00", "aruba": { - "bgp": { - "as_number": 1234 - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8587,35 +11708,34 @@ "category": [ "network" ], - "code": "2906", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2906|LOG_INFO|AMM|1/1|BGP AS 1234 unconfigured. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3219", + "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3219|LOG_INFO|Module|-|Ethernet module eth0 main power enabled" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "BGP AS 1234 unconfigured. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 main power enabled", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:04:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8625,41 +11745,34 @@ "category": [ "network" ], - "code": "2907", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2907|LOG_INFO|AMM|1/1|BGP router-id changed. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3220", + "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3220|LOG_ERR|Module|-|Ethernet module eth0 main power failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "BGP router-id changed. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 main power failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" - } - }, - "destination": { - "address": "127.0.0.1", - "as": { - "number": 1 + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8669,40 +11782,36 @@ "category": [ "network" ], - "code": "2908", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2908|LOG_INFO|AMM|1/1|127.0.0.1: Peer configured, AS 1. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3221", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3221|LOG_INFO|Module|-|Ethernet module eth0 device initialization started" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer configured, AS 1. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 device initialization started", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8710,40 +11819,36 @@ "category": [ "network" ], - "code": "2909", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2909|LOG_INFO|AMM|1/1|8360-ServerName: User reset request. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3222", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3222|LOG_INFO|Module|-|Ethernet module eth0 device initialization passed" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: User reset request. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 device initialization passed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8751,40 +11856,37 @@ "category": [ "network" ], - "code": "2910", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2910|LOG_INFO|AMM|1/1|8360-ServerName: Peer password changed. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3223", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3223|LOG_ERR|Module|-|Ethernet module eth0 device initialization failed: hardware error", + "reason": "hardware error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer password changed. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 device initialization failed: hardware error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8792,40 +11894,36 @@ "category": [ "network" ], - "code": "2911", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2911|LOG_INFO|AMM|1/1|8360-ServerName: Peer deleted. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3224", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3224|LOG_INFO|Module|-|Ethernet module eth0 ASIC initialization started" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer deleted. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ASIC initialization started", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8833,40 +11931,36 @@ "category": [ "network" ], - "code": "2912", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2912|LOG_INFO|AMM|1/1|8360-ServerName: Peer admin disabled. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3225", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3225|LOG_INFO|Module|-|Ethernet module eth0 ASIC initialization completed" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer admin disabled. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ASIC initialization completed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -8874,41 +11968,35 @@ "category": [ "network" ], - "code": "2913", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2913|LOG_INFO|AMM|1/1|8360-ServerName: Peer admin enabled. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3226", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3226|LOG_ERR|Module|-|Ethernet module eth0 ASIC initialization failed: hardware error", + "reason": "hardware error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer admin enabled. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ASIC initialization failed: hardware error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" - } - }, - "destination": { - "address": "127.0.0.1", - "as": { - "number": 1 + "module": { + "name": "eth0", + "type": "Ethernet" } }, "ecs": { @@ -8918,45 +12006,36 @@ "category": [ "network" ], - "code": "2914", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2914|LOG_INFO|AMM|1/1|127.0.0.1: Peer remote-as changed to 1. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3227", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3227|LOG_INFO|Module|-|Ethernet module eth0 ASIC deinitialization started" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer remote-as changed to 1. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ASIC deinitialization started", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" - } - }, - "client": { - "as": { - "number": 1 + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "127.0.0.1" - }, "ecs": { "version": "8.11.0" }, @@ -8964,40 +12043,36 @@ "category": [ "network" ], - "code": "2915", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2915|LOG_INFO|AMM|1/1|127.0.0.1: Peer local-as changed to 1. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3228", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3228|LOG_INFO|Module|-|Ethernet module eth0 ASIC deinitialization completed" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "127.0.0.1: Peer local-as changed to 1. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 ASIC deinitialization completed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "eth0", + "type": "Ethernet" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -9005,43 +12080,36 @@ "category": [ "network" ], - "code": "2916", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2916|LOG_INFO|AMM|1/1|8360-ServerName: Peer source-address changed to 127.0.0.1. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3229", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3229|LOG_ERR|Module|-|Ethernet module eth0 ASIC deinitialization failed: hardware error", + "reason": "hardware error" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer source-address changed to 127.0.0.1. vrf-name: vpn-Internet", - "source": { - "ip": "127.0.0.1" - }, + "message": "Ethernet module eth0 ASIC deinitialization failed: hardware error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "mock_name" } }, - "destination": { - "address": "8360-ServerName" - }, "ecs": { "version": "8.11.0" }, @@ -9049,43 +12117,35 @@ "category": [ "network" ], - "code": "2917", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2917|LOG_INFO|AMM|1/1|8360-ServerName: Peer remove-private-as configuration changed. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3230", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3230|LOG_INFO|Module|-|mock_name is starting zeroization" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "8360-ServerName: Peer remove-private-as configuration changed. vrf-name: vpn-Internet", + "message": "mock_name is starting zeroization", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { - "bgp": { - "id": "1234" - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "mock_name" } }, - "destination": { - "address": "127.0.0.1" - }, "ecs": { "version": "8.11.0" }, @@ -9093,38 +12153,33 @@ "category": [ "network" ], - "code": "2918", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2918|LOG_INFO|AMM|1/1|1234: BGP identifier sent by Peer 127.0.0.1 matches ours. BGP session may not established. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3231", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3231|LOG_INFO|Module|-|mock_name zeroization completed" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "1234: BGP identifier sent by Peer 127.0.0.1 matches ours. BGP session may not established. vrf-name: vpn-Internet", + "message": "mock_name zeroization completed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "limit": { - "threshold": "10" - }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" + "module": { + "name": "mock_name" } }, "ecs": { @@ -9134,44 +12189,36 @@ "category": [ "network" ], - "code": "2919", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2919|LOG_CRIT|AMM|1/1|The BGP RIB has reached the threshold limit of 10 for VRF vpn-Internet': yes", - "sequence": 1 + "code": "3232", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3232|LOG_ERR|Module|-|mock_name zeroization failed" }, "log": { - "level": "LOG_CRIT", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "The BGP RIB has reached the threshold limit of 10 for VRF vpn-Internet': yes", + "message": "mock_name zeroization failed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { - "bgp": { - "pg_name": "pg_name" - }, "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "sequence": "1/1", - "vrf": { - "name": "vpn-Internet" - } - }, - "destination": { - "as": { - "number": 10 - } + "module": { + "name": "eth0", + "type": "Ethernet" + }, + "unit": "12345" }, "ecs": { "version": "8.11.0" @@ -9180,274 +12227,258 @@ "category": [ "network" ], - "code": "2920", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|2920|LOG_INFO|AMM|1/1|pg_name: Peer-group configured with remote-as 10. vrf-name: vpn-Internet", - "sequence": 1 + "code": "3233", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3233|LOG_INFO|Module|-|Ethernet module eth0 configured with product number 12345" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "pg_name: Peer-group configured with remote-as 10. vrf-name: vpn-Internet", + "message": "Ethernet module eth0 configured with product number 12345", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:58:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1", - "slot": 1 + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3001", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3001|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on management module 1", - "sequence": 1 + "code": "3234", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3234|LOG_INFO|Module|-|Ethernet module eth0 has been unconfigured" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code on management module 1", + "message": "Ethernet module eth0 has been unconfigured", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:59:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1", - "slot": 2 + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3002", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3002|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on line card 2", - "sequence": 1 + "code": "3235", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3235|LOG_INFO|Module|-|Ethernet module eth0 initiating failover" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code on line card 2", + "message": "Ethernet module eth0 initiating failover", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:00:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1", - "slot": 3 + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3003", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3003|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on fabric card 3", - "sequence": 1 + "code": "3236", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3236|LOG_INFO|Module|-|Ethernet module eth0 failover completed" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code on fabric card 3", + "message": "Ethernet module eth0 failover completed", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:01:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1", - "slot": 4 + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3004", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3004|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on fan tray 4", - "sequence": 1 + "code": "3237", + "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3237|LOG_INFO|Module|-|Ethernet module eth0 initiating ISP" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code on fan tray 4", + "message": "Ethernet module eth0 initiating ISP", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:02:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1", - "slot": 5 + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3005", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3005|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code on rear display card 5", - "sequence": 1 + "code": "3238", + "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3238|LOG_INFO|Module|-|Ethernet module eth0 enabling front-end power" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code on rear display card 5", + "message": "Ethernet module eth0 enabling front-end power", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:03:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "test_name": "mock_test_name" + "device": "8360-Primaire" }, - "sequence": "1/1" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" }, - "error": { - "code": "mock_error_code" - }, "event": { "category": [ "network" ], - "code": "3006", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3006|LOG_ERR|AMM|1/1|Diagnostic mock_test_name failed with error code mock_error_code for the system", - "sequence": 1 + "code": "3239", + "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3239|LOG_WARN|Module|-|Ethernet module eth0 disabling front-end power: power failure", + "reason": "power failure" }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "Diagnostic mock_test_name failed with error code mock_error_code for the system", + "message": "Ethernet module eth0 disabling front-end power: power failure", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T13:04:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "Module" }, "event_type": "Event", "hardware": { - "device": "8360-Primaire", - "location": "mock_location", - "origin": "mock_origin" + "device": "8360-Primaire" }, - "sequence": "1/1" + "module": { + "name": "eth0", + "type": "Ethernet" + } }, "ecs": { "version": "8.11.0" @@ -9456,37 +12487,31 @@ "category": [ "network" ], - "code": "3007", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3007|LOG_WARN|AMM|1/1|There are mock_origin happening on mock_location", - "sequence": 1 + "code": "3240", + "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3240|LOG_ERR|Module|-|Ethernet module eth0 has persistent hardware error" }, "log": { - "level": "LOG_WARN", + "level": "LOG_ERR", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-module", + "procid": "1234" } }, - "message": "There are mock_origin happening on mock_location", + "message": "Ethernet module eth0 has persistent hardware error", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-21T18:32:07.025548-05:00", "aruba": { "component": { - "category": "AMM" + "category": "DHCPv6" }, "event_type": "Event", "hardware": { - "bus": "mock_bus", - "device": "mock_device", - "function": "mock_function", - "location": "mock_location", - "seg": "mock_seg" - }, - "sequence": "1/1" + "device": "8360-Primaire" + } }, "ecs": { "version": "8.11.0" @@ -9495,39 +12520,31 @@ "category": [ "network" ], - "code": "3008", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3008|LOG_WARN|AMM|1/1|There are IO errors on mock_location from mock_seg:mock_bus:mock_device:mock_function", - "sequence": 1 + "code": "3301", + "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3301|LOG_INFO|DHCPv6|-|DHCPv6 Relay Enabled" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "dhcpd", + "procid": "999" } }, - "message": "There are IO errors on mock_location from mock_seg:mock_bus:mock_device:mock_function", + "message": "DHCPv6 Relay Enabled", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-21T18:32:07.025548-05:00", "aruba": { "component": { - "category": "AMM" + "category": "DHCPv6" }, "event_type": "Event", "hardware": { - "addr": "mock_addr", - "cap": "mock_cap", - "device": "8360-Primaire", - "location": "mock_location", - "mcgstatus": "mock_mcgstatus", - "misc": "mock_misc" - }, - "sequence": "1/1", - "status": "mock_status" + "device": "8360-Primaire" + } }, "ecs": { "version": "8.11.0" @@ -9536,37 +12553,31 @@ "category": [ "network" ], - "code": "3009", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3009|LOG_INFO|AMM|1/1|There are unknown errors on mock_location from mock_status:mock_addr:mock_misc:mock_mcgstatus:mock_cap", - "sequence": 1 + "code": "3302", + "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3302|LOG_INFO|DHCPv6|-|DHCPv6 Relay Disabled" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "dhcpd", + "procid": "999" } }, - "message": "There are unknown errors on mock_location from mock_status:mock_addr:mock_misc:mock_mcgstatus:mock_cap", + "message": "DHCPv6 Relay Disabled", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-21T18:32:07.025548-05:00", "aruba": { "component": { - "category": "AMM" + "category": "DHCPD" }, "event_type": "Event", "hardware": { - "cpus": 2, - "device": "8360-Primaire", - "level": "mock_level", - "offlined": 1, - "type": "mock_type" - }, - "sequence": "1/1" + "device": "8360-Primaire" + } }, "ecs": { "version": "8.11.0" @@ -9575,38 +12586,31 @@ "category": [ "network" ], - "code": "3010", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3010|LOG_WARN|AMM|1/1|CPUs 2 Lmock_level mock_type cache error detected. CPUs 1 offlined", - "sequence": 1 + "code": "3401", + "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3401|LOG_INFO|DHCPD|-|DHCP Relay Enabled" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "dhcpd", + "procid": "999" } }, - "message": "CPUs 2 Lmock_level mock_type cache error detected. CPUs 1 offlined", + "message": "DHCP Relay Enabled", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-21T18:32:07.025548-05:00", "aruba": { "component": { - "category": "AMM" + "category": "DHCPD" }, "event_type": "Event", "hardware": { - "cecount": 1, - "device": "8360-Primaire", - "socket": "mock_socket" - }, - "limit": { - "threshold": "1" - }, - "sequence": "1/1" + "device": "8360-Primaire" + } }, "ecs": { "version": "8.11.0" @@ -9615,38 +12619,34 @@ "category": [ "network" ], - "code": "3011", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3011|LOG_WARN|AMM|1/1|Socket mock_socket correctable memory error count 1 exceeded threshold 1", - "sequence": 1 + "code": "3402", + "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3402|LOG_INFO|DHCPD|-|DHCP Relay Disabled" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "dhcpd", + "procid": "999" } }, - "message": "Socket mock_socket correctable memory error count 1 exceeded threshold 1", + "message": "DHCP Relay Disabled", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "IRDP" }, "event_type": "Event", "hardware": { - "cecount": 2, - "channel": "mock_channel", "device": "8360-Primaire" }, - "limit": { - "threshold": "1" - }, - "sequence": "1/1" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9655,39 +12655,34 @@ "category": [ "network" ], - "code": "3012", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3012|LOG_WARN|AMM|1/1|Module mock_channel correctable memory error count 2 exceeded threshold 1", - "sequence": 1 + "code": "3501", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-irdp[1234]: Event|3501|LOG_INFO|IRDP|-|IRDP enabled on interface eth0" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-irdp", + "procid": "1234" } }, - "message": "Module mock_channel correctable memory error count 2 exceeded threshold 1", + "message": "IRDP enabled on interface eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-19T14:22:07.025548-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { - "cecount": 2, - "device": "8360-Primaire", - "offlined": 3, - "page": "mock_page" - }, - "limit": { - "threshold": "1" + "device": "8360-Primaire" }, - "sequence": "1/1" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9696,33 +12691,34 @@ "category": [ "network" ], - "code": "3013", - "original": "2024-06-19T14:22:07.025548-05:00 8360-Primaire acctd[358]: Event|3013|LOG_WARN|AMM|1/1|Page mock_page correctable memory error count 2 exceeded threshold 1 and 3", - "sequence": 1 + "code": "3901", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3901|LOG_INFO|IPV6ROUTER|-|ipv6 ra enabled on interface: eth0" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "acctd", - "procid": "358" + "appname": "hpe-ipv6ra", + "procid": "1234" } }, - "message": "Page mock_page correctable memory error count 2 exceeded threshold 1 and 3", + "message": "ipv6 ra enabled on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "MVRP" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9731,32 +12727,34 @@ "category": [ "network" ], - "code": "3101", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3101|LOG_INFO|MVRP|-|MVRP enabled on port eth0" + "code": "3902", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3902|LOG_INFO|IPV6ROUTER|-|ipv6 ra disabled on interface: eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-mvrp", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "MVRP enabled on port eth0", + "message": "ipv6 ra disabled on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "MVRP" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9765,33 +12763,33 @@ "category": [ "network" ], - "code": "3102", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3102|LOG_INFO|MVRP|-|MVRP disabled on port eth0" + "code": "3903", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3903|LOG_INFO|IPV6ROUTER|-|Disabled sending MTU in Router-Advertisement messages on eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-mvrp", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "MVRP disabled on port eth0", + "message": "Disabled sending MTU in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "MVRP" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "limit": { - "threshold": "50" + "interface": { + "id": "eth0" } }, "ecs": { @@ -9801,37 +12799,34 @@ "category": [ "network" ], - "code": "3103", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3103|LOG_ERR|MVRP|-|MVRP failed to create VLAN 100. Maximum VLANs 50 already created throttle_count: 100" + "code": "3904", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3904|LOG_INFO|IPV6ROUTER|-|Enabled sending MTU in Router-Advertisement messages on eth0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-mvrp", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "MVRP failed to create VLAN 100. Maximum VLANs 50 already created throttle_count: 100", - "network": { - "vlan": { - "id": "100" - } - }, + "message": "Enabled sending MTU in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "MVRP" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9840,32 +12835,34 @@ "category": [ "network" ], - "code": "3104", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3104|LOG_INFO|MVRP|-|MVRP statistics have been cleared for port eth0" + "code": "3905", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3905|LOG_INFO|IPV6ROUTER|-|Disabled sending RDNSS in Router-Advertisement messages on eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-mvrp", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "MVRP statistics have been cleared for port eth0", + "message": "Disabled sending RDNSS in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "MVRP" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "5" + "interface": { + "id": "eth0" + } }, "ecs": { "version": "8.11.0" @@ -9874,34 +12871,33 @@ "category": [ "network" ], - "code": "3105", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-mvrp[1234]: Event|3105|LOG_INFO|MVRP|-|MVRP statistics have been cleared for 5 ports" + "code": "3906", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3906|LOG_INFO|IPV6ROUTER|-|Enabled sending RDNSS in Router-Advertisement messages on eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-mvrp", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "MVRP statistics have been cleared for 5 ports", + "message": "Enabled sending RDNSS in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -9911,34 +12907,33 @@ "category": [ "network" ], - "code": "3201", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3201|LOG_INFO|Module|-|Ethernet module eth0 inserted" + "code": "3907", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3907|LOG_INFO|IPV6ROUTER|-|Disabled sending DNSSL in Router-Advertisement messages on eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 inserted", + "message": "Disabled sending DNSSL in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -9948,34 +12943,33 @@ "category": [ "network" ], - "code": "3202", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3202|LOG_WARN|Module|-|Ethernet module eth0 removed" + "code": "3908", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3908|LOG_INFO|IPV6ROUTER|-|Enabled sending DNSSL in Router-Advertisement messages on eth0" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 removed", + "message": "Enabled sending DNSSL in Router-Advertisement messages on eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Initiating Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -9985,34 +12979,33 @@ "category": [ "network" ], - "code": "3203", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3203|LOG_INFO|Module|-|Initiating Ethernet module eth0 reboot" + "code": "3909", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3909|LOG_INFO|IPV6ROUTER|-|Interface: eth0 is added to router discovery" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Initiating Ethernet module eth0 reboot", + "message": "Interface: eth0 is added to router discovery", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10022,35 +13015,35 @@ "category": [ "network" ], - "code": "3204", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3204|LOG_INFO|Module|-|Ethernet module eth0 is ready" + "code": "3910", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3910|LOG_INFO|IPV6ROUTER|-|Interface: eth0 is deleted from router discovery" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 is ready", + "message": "Interface: eth0 is deleted from router discovery", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-18T12:55:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "interface": { + "id": "eth0" + }, + "len": 64 }, "ecs": { "version": "8.11.0" @@ -10059,36 +13052,38 @@ "category": [ "network" ], - "code": "3205", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3205|LOG_INFO|Module|-|Ethernet module eth0 is down: hardware failure", - "reason": "hardware failure" + "code": "3911", + "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3911|LOG_INFO|IPV6ROUTER|-|Added ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 is down: hardware failure", + "message": "Added ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0", + "server": { + "ip": "FE80::C000:1DFF:FEE0:C01" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:56:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "interface": { + "id": "eth0" + }, + "len": 64 }, "ecs": { "version": "8.11.0" @@ -10097,35 +13092,38 @@ "category": [ "network" ], - "code": "3206", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3206|LOG_INFO|Module|-|Ethernet module eth0 is in diagnostics mode" + "code": "3912", + "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3912|LOG_INFO|IPV6ROUTER|-|Deleted ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 from interface: eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 is in diagnostics mode", + "message": "Deleted ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 from interface: eth0", + "server": { + "ip": "FE80::C000:1DFF:FEE0:C01" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:57:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "interface": { + "id": "eth0" + }, + "prefix": "FE80::C000:1DFF:FEE0:C01/64" }, "ecs": { "version": "8.11.0" @@ -10134,36 +13132,35 @@ "category": [ "network" ], - "code": "3207", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3207|LOG_ERR|Module|-|Ethernet module eth0 has failed: hardware failure", - "reason": "hardware failure" + "code": "3913", + "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3913|LOG_INFO|IPV6ROUTER|-|Added RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 to prefix list" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 has failed: hardware failure", + "message": "Added RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 to prefix list", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:58:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "interface": { + "id": "eth0" + }, + "prefix": "FE80::C000:1DFF:FEE0:C01/64" }, "ecs": { "version": "8.11.0" @@ -10172,34 +13169,33 @@ "category": [ "network" ], - "code": "3208", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3208|LOG_INFO|Module|-|Ethernet module eth0 admin state set to up" + "code": "3914", + "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3914|LOG_INFO|IPV6ROUTER|-|Deleted RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 from prefix list" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 admin state set to up", + "message": "Deleted RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 from prefix list", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:59:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10209,34 +13205,33 @@ "category": [ "network" ], - "code": "3209", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3209|LOG_INFO|Module|-|Ethernet module eth0 admin state set to down" + "code": "3915", + "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3915|LOG_INFO|IPV6ROUTER|-|default prefix is configured on interface eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 admin state set to down", + "message": "default prefix is configured on interface eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T13:00:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10246,34 +13241,33 @@ "category": [ "network" ], - "code": "3210", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3210|LOG_INFO|Module|-|Ethernet module eth0 admin state set to diagnostics" + "code": "3916", + "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3916|LOG_INFO|IPV6ROUTER|-|RDNSS is added on interface: eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 admin state set to diagnostics", + "message": "RDNSS is added on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10283,34 +13277,33 @@ "category": [ "network" ], - "code": "3211", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3211|LOG_INFO|Module|-|Ethernet module eth0 ISP passed" + "code": "3917", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3917|LOG_INFO|IPV6ROUTER|-|RDNSS is deleted on interface: eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 ISP passed", + "message": "RDNSS is deleted on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10320,34 +13313,33 @@ "category": [ "network" ], - "code": "3212", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3212|LOG_ERR|Module|-|Ethernet module eth0 ISP failed" + "code": "3918", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3918|LOG_INFO|IPV6ROUTER|-|DNSSL is added on interface: eth0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 ISP failed", + "message": "DNSSL is added on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "IPV6ROUTER" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "interface": { + "id": "eth0" } }, "ecs": { @@ -10357,34 +13349,33 @@ "category": [ "network" ], - "code": "3213", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3213|LOG_WARN|Module|-|Ethernet module eth0 ISP skipped" + "code": "3919", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3919|LOG_INFO|IPV6ROUTER|-|DNSSL is deleted on interface: eth0" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-ipv6ra", "procid": "1234" } }, - "message": "Ethernet module eth0 ISP skipped", + "message": "DNSSL is deleted on interface: eth0", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "MULTICAST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "limit": { + "threshold": "100" } }, "ecs": { @@ -10394,36 +13385,35 @@ "category": [ "network" ], - "code": "3214", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3214|LOG_INFO|Module|-|Ethernet module eth0 has enabled standby power" + "code": "4001", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-multicast[1234]: Event|4001|LOG_WARN|MULTICAST|-|The Multicast L3 Bridge Control Forwarding entries limit was reached: 100" }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-module", + "appname": "hpe-multicast", "procid": "1234" } }, - "message": "Ethernet module eth0 has enabled standby power", + "message": "The Multicast L3 Bridge Control Forwarding entries limit was reached: 100", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "PROXYARP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - }, - "priority": "high" + "port": "eth0", + "vrf": { + "id": "vrf1" + } }, "ecs": { "version": "8.11.0" @@ -10432,34 +13422,34 @@ "category": [ "network" ], - "code": "3215", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3215|LOG_INFO|Module|-|Ethernet module eth0 is requesting to power on with priority high" + "code": "4205", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4205|LOG_INFO|PROXYARP|-|Local proxy ARP enabled for port eth0 on vrf vrf1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-arp", "procid": "1234" } }, - "message": "Ethernet module eth0 is requesting to power on with priority high", + "message": "Local proxy ARP enabled for port eth0 on vrf vrf1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "PROXYARP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "port": "eth0", + "vrf": { + "id": "vrf1" } }, "ecs": { @@ -10469,34 +13459,34 @@ "category": [ "network" ], - "code": "3216", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3216|LOG_INFO|Module|-|Ethernet module eth0 power request has been granted" + "code": "4206", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4206|LOG_INFO|PROXYARP|-|Local proxy ARP disabled for port eth0 on vrf vrf1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-arp", "procid": "1234" } }, - "message": "Ethernet module eth0 power request has been granted", + "message": "Local proxy ARP disabled for port eth0 on vrf vrf1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "PROXYARP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "port": "eth0", + "vrf": { + "id": "vrf1" } }, "ecs": { @@ -10506,34 +13496,34 @@ "category": [ "network" ], - "code": "3217", - "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3217|LOG_ERR|Module|-|Ethernet module eth0 power request has been denied" + "code": "4207", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4207|LOG_ERR|PROXYARP|-|Failed to enable local proxy ARP for port eth0 on vrf vrf1" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-arp", "procid": "1234" } }, - "message": "Ethernet module eth0 power request has been denied", + "message": "Failed to enable local proxy ARP for port eth0 on vrf vrf1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:02:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "PROXYARP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "port": "eth0", + "vrf": { + "id": "vrf1" } }, "ecs": { @@ -10543,34 +13533,39 @@ "category": [ "network" ], - "code": "3218", - "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3218|LOG_INFO|Module|-|Ethernet module eth0 enabling main power" + "code": "4208", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4208|LOG_ERR|PROXYARP|-|Failed to disable local proxy ARP for port eth0 on vrf vrf1" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-arp", "procid": "1234" } }, - "message": "Ethernet module eth0 enabling main power", + "message": "Failed to disable local proxy ARP for port eth0 on vrf vrf1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:03:38.182641-05:00", + "@timestamp": "2023-11-30T11:09:33.733026-05:00", + "_temp": {}, "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "mgmt": { + "config_err": { + "default_gateway": "127.0.0.1", + "domain_name": "", + "hostname": "8360-ServerName", + "ip": "127.0.0.1" + } } }, "ecs": { @@ -10580,34 +13575,33 @@ "category": [ "network" ], - "code": "3219", - "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3219|LOG_INFO|Module|-|Ethernet module eth0 main power enabled" + "code": "4302", + "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4302|LOG_INFO|AMM|-|MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}]" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "ops_mgmtintfcfg", + "procid": "3485" } }, - "message": "Ethernet module eth0 main power enabled", + "message": "MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}]", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:04:38.182641-05:00", + "@timestamp": "2023-11-30T11:09:33.733026-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "mgmt": { + "config_err": "Link state is down." } }, "ecs": { @@ -10617,34 +13611,39 @@ "category": [ "network" ], - "code": "3220", - "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3220|LOG_ERR|Module|-|Ethernet module eth0 main power failed" + "code": "4302", + "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4302|LOG_INFO|AMM|-|MGMT_INTF: Link state is down." }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "ops_mgmtintfcfg", + "procid": "3485" } }, - "message": "Ethernet module eth0 main power failed", + "message": "MGMT_INTF: Link state is down.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2023-11-30T11:09:33.733026-05:00", + "_temp": {}, "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "mgmt": { + "config_crit": { + "default_gateway": "127.0.0.1", + "domain_name": "", + "hostname": "8360-ServerName", + "ip": "127.0.0.1" + } } }, "ecs": { @@ -10654,34 +13653,36 @@ "category": [ "network" ], - "code": "3221", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3221|LOG_INFO|Module|-|Ethernet module eth0 device initialization started" + "code": "4303", + "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4303|LOG_INFO|AMM|-|MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}] is updated in ovsdb." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "ops_mgmtintfcfg", + "procid": "3485" } }, - "message": "Ethernet module eth0 device initialization started", + "message": "MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}] is updated in ovsdb.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-20T14:00:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", + "firmware": { + "after": "1.1.0", + "before": "1.0.0", + "dnld_type": "TFTP", + "image_profile": "primary" + }, "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10691,34 +13692,42 @@ "category": [ "network" ], - "code": "3222", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3222|LOG_INFO|Module|-|Ethernet module eth0 device initialization passed" + "code": "4401", + "original": "2024-06-20T14:00:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4401|LOG_INFO|AMM|-|User admin: primary image updated via TFTP from 192.168.1.1. Firmware version, Before Update: 1.0.0 After Update: 1.1.0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 device initialization passed", + "message": "User admin: primary image updated via TFTP from 192.168.1.1. Firmware version, Before Update: 1.0.0 After Update: 1.1.0", + "source": { + "address": "192.168.1.1" + }, "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-20T14:01:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", + "firmware": { + "after": "1.1.0", + "before": "1.0.0", + "dnld_type": "USB", + "image_profile": "secondary" + }, "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10728,35 +13737,37 @@ "category": [ "network" ], - "code": "3223", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3223|LOG_ERR|Module|-|Ethernet module eth0 device initialization failed: hardware error", - "reason": "hardware error" + "code": "4402", + "original": "2024-06-20T14:01:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4402|LOG_INFO|AMM|-|User admin: secondary image updated via USB. Firmware version, Before Update: 1.0.0 After Update: 1.1.0" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 device initialization failed: hardware error", + "message": "User admin: secondary image updated via USB. Firmware version, Before Update: 1.0.0 After Update: 1.1.0", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-20T14:02:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", + "firmware": { + "dnld_type": "TFTP", + "image_profile": "primary" + }, "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10766,34 +13777,40 @@ "category": [ "network" ], - "code": "3224", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3224|LOG_INFO|Module|-|Ethernet module eth0 ASIC initialization started" + "code": "4403", + "original": "2024-06-20T14:02:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4403|LOG_ERR|AMM|-|User admin: primary image update failed via TFTP from 192.168.1.1" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 ASIC initialization started", + "message": "User admin: primary image update failed via TFTP from 192.168.1.1", + "source": { + "address": "192.168.1.1" + }, "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "@timestamp": "2024-06-20T14:03:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", + "firmware": { + "dnld_type": "USB", + "image_profile": "secondary" + }, "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10803,34 +13820,33 @@ "category": [ "network" ], - "code": "3225", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3225|LOG_INFO|Module|-|Ethernet module eth0 ASIC initialization completed" + "code": "4404", + "original": "2024-06-20T14:03:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4404|LOG_ERR|AMM|-|User admin: secondary image update failed via USB" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 ASIC initialization completed", + "message": "User admin: secondary image update failed via USB", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-20T14:04:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10840,35 +13856,30 @@ "category": [ "network" ], - "code": "3226", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3226|LOG_ERR|Module|-|Ethernet module eth0 ASIC initialization failed: hardware error", - "reason": "hardware error" + "code": "4405", + "original": "2024-06-20T14:04:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4405|LOG_ERR|AMM|-|Firmware image signature not valid" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 ASIC initialization failed: hardware error", + "message": "Firmware image signature not valid", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-20T14:05:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10878,34 +13889,30 @@ "category": [ "network" ], - "code": "3227", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3227|LOG_INFO|Module|-|Ethernet module eth0 ASIC deinitialization started" + "code": "4406", + "original": "2024-06-20T14:05:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4406|LOG_ERR|AMM|-|Firmware image is not compatible with hardware" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", - "procid": "1234" + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 ASIC deinitialization started", + "message": "Firmware image is not compatible with hardware", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-20T14:06:38.324517-05:00", "aruba": { "component": { - "category": "Module" + "category": "AMM" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -10915,35 +13922,32 @@ "category": [ "network" ], - "code": "3228", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3228|LOG_INFO|Module|-|Ethernet module eth0 ASIC deinitialization completed" + "code": "4407", + "original": "2024-06-20T14:06:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4407|LOG_ERR|AMM|-|Firmware image is invalid" }, "log": { - "level": "LOG_INFO", - "syslog": { - "appname": "hpe-module", - "procid": "1234" + "level": "LOG_ERR", + "syslog": { + "appname": "hpe-firmware", + "procid": "1989034" } }, - "message": "Ethernet module eth0 ASIC deinitialization completed", + "message": "Firmware image is invalid", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "SELFTEST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "subsystem": "subsystem1" }, "ecs": { "version": "8.11.0" @@ -10952,35 +13956,32 @@ "category": [ "network" ], - "code": "3229", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3229|LOG_ERR|Module|-|Ethernet module eth0 ASIC deinitialization failed: hardware error", - "reason": "hardware error" + "code": "4501", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4501|LOG_INFO|SELFTEST|-|Selftest has started on subsystem subsystem1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-selftest", "procid": "1234" } }, - "message": "Ethernet module eth0 ASIC deinitialization failed: hardware error", + "message": "Selftest has started on subsystem subsystem1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "SELFTEST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "mock_name" - } + "subsystem": "subsystem1" }, "ecs": { "version": "8.11.0" @@ -10989,34 +13990,32 @@ "category": [ "network" ], - "code": "3230", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3230|LOG_INFO|Module|-|mock_name is starting zeroization" + "code": "4502", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4502|LOG_INFO|SELFTEST|-|Selftest has completed on subsystem subsystem1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-selftest", "procid": "1234" } }, - "message": "mock_name is starting zeroization", + "message": "Selftest has completed on subsystem subsystem1", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "SELFTEST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "mock_name" - } + "subsystem": "subsystem1" }, "ecs": { "version": "8.11.0" @@ -11025,34 +14024,39 @@ "category": [ "network" ], - "code": "3231", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3231|LOG_INFO|Module|-|mock_name zeroization completed" + "code": "4503", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4503|LOG_ERR|SELFTEST|-|Selftest has failed on subsystem subsystem1 with error code 1234", + "reason": "1234" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-selftest", "procid": "1234" } }, - "message": "mock_name zeroization completed", + "message": "Selftest has failed on subsystem subsystem1 with error code 1234", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "SELFTEST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "mock_name" - } + "interface": { + "id": "interface1" + }, + "self_test": { + "stack": "stack1" + }, + "slot": 1 }, "ecs": { "version": "8.11.0" @@ -11061,36 +14065,37 @@ "category": [ "network" ], - "code": "3232", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3232|LOG_ERR|Module|-|mock_name zeroization failed" + "code": "4504", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-selftest[1234]: Event|4504|LOG_ERR|SELFTEST|-|Selftest has failed on stack1/1/interface1 with error code 5678", + "reason": "5678" }, "log": { "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-selftest", "procid": "1234" } }, - "message": "mock_name zeroization failed", + "message": "Selftest has failed on stack1/1/interface1 with error code 5678", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - }, - "unit": "12345" + "rest": { + "autztype": "new_type", + "match": "/old/url", + "type": "old_type" + } }, "ecs": { "version": "8.11.0" @@ -11099,34 +14104,33 @@ "category": [ "network" ], - "code": "3233", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3233|LOG_INFO|Module|-|Ethernet module eth0 configured with product number 12345" + "code": "4603", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4603|LOG_ERR|REST|-|Conflict in authorization configuration. Existing config::URL(/old/url), type(old_type) New config::(/new/url), type(new_type)" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 configured with product number 12345", + "message": "Conflict in authorization configuration. Existing config::URL(/old/url), type(old_type) New config::(/new/url), type(new_type)", "tags": [ "preserve_original_event" - ] + ], + "url": { + "original": "/new/url" + } }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -11136,34 +14140,30 @@ "category": [ "network" ], - "code": "3234", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3234|LOG_INFO|Module|-|Ethernet module eth0 has been unconfigured" + "code": "4604", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4604|LOG_INFO|REST|-|Session started for user admin, session 12345" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 has been unconfigured", + "message": "Session started for user admin, session 12345", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -11173,109 +14173,115 @@ "category": [ "network" ], - "code": "3235", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3235|LOG_INFO|Module|-|Ethernet module eth0 initiating failover" + "code": "4605", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4605|LOG_INFO|REST|-|Session ended for user admin, session 12345" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 initiating failover", + "message": "Session ended for user admin, session 12345", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "rest": { + "resource": "/resource" } }, "ecs": { "version": "8.11.0" }, "event": { + "action": "read", "category": [ "network" ], - "code": "3236", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3236|LOG_INFO|Module|-|Ethernet module eth0 failover completed" + "code": "4606", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4606|LOG_ERR|REST|-|Authorization failed for user admin, for resource /resource, with action read" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 failover completed", + "message": "Authorization failed for user admin, for resource /resource, with action read", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T13:01:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "rest": { + "resource": "/resource" } }, "ecs": { "version": "8.11.0" }, "event": { + "action": "read", "category": [ "network" ], - "code": "3237", - "original": "2024-06-18T13:01:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3237|LOG_INFO|Module|-|Ethernet module eth0 initiating ISP" + "code": "4608", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4608|LOG_INFO|REST|-|Authorization allowed for user admin, for resource /resource, with action read" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 initiating ISP", + "message": "Authorization allowed for user admin, for resource /resource, with action read", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T13:02:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" - } + "rest": { + "added_user": "new_user" + }, + "role": "admin" }, "ecs": { "version": "8.11.0" @@ -11284,34 +14290,36 @@ "category": [ "network" ], - "code": "3238", - "original": "2024-06-18T13:02:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3238|LOG_INFO|Module|-|Ethernet module eth0 enabling front-end power" + "code": "4609", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4609|LOG_INFO|REST|-|User admin added new_user with role admin" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 enabling front-end power", + "message": "User admin added new_user with role admin", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T13:03:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "module": { - "name": "eth0", - "type": "Ethernet" + "rest": { + "deleted_user": "old_user" } }, "ecs": { @@ -11321,35 +14329,33 @@ "category": [ "network" ], - "code": "3239", - "original": "2024-06-18T13:03:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3239|LOG_WARN|Module|-|Ethernet module eth0 disabling front-end power: power failure", - "reason": "power failure" + "code": "4610", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4610|LOG_INFO|REST|-|User admin deleted old_user" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 disabling front-end power: power failure", + "message": "User admin deleted old_user", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T13:04:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "Module" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "module": { - "name": "eth0", - "type": "Ethernet" } }, "ecs": { @@ -11359,26 +14365,29 @@ "category": [ "network" ], - "code": "3240", - "original": "2024-06-18T13:04:38.182641-05:00 8360-Primaire hpe-module[1234]: Event|3240|LOG_ERR|Module|-|Ethernet module eth0 has persistent hardware error" + "code": "4611", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4611|LOG_INFO|REST|-|User admin successfully changed password" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-module", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Ethernet module eth0 has persistent hardware error", + "message": "User admin successfully changed password", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-21T18:32:07.025548-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "DHCPv6" + "category": "REST" }, "event_type": "Event", "hardware": { @@ -11392,30 +14401,36 @@ "category": [ "network" ], - "code": "3301", - "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3301|LOG_INFO|DHCPv6|-|DHCPv6 Relay Enabled" + "code": "4612", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4612|LOG_WARN|REST|-|User admin password change failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "dhcpd", - "procid": "999" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "DHCPv6 Relay Enabled", + "message": "User admin password change failed", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-21T18:32:07.025548-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "DHCPv6" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "config_name": "switch_config_1" } }, "ecs": { @@ -11425,30 +14440,37 @@ "category": [ "network" ], - "code": "3302", - "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3302|LOG_INFO|DHCPv6|-|DHCPv6 Relay Disabled" + "code": "4613", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4613|LOG_INFO|REST|-|admin has written a new switch configuration to switch_config_1" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "999" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "DHCPv6 Relay Disabled", + "message": "admin has written a new switch configuration to switch_config_1", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-21T18:32:07.025548-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "DHCPD" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "config_from_name": "config_old", + "config_to_name": "config_new" } }, "ecs": { @@ -11458,30 +14480,37 @@ "category": [ "network" ], - "code": "3401", - "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3401|LOG_INFO|DHCPD|-|DHCP Relay Enabled" + "code": "4614", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4614|LOG_INFO|REST|-|admin has copied switch configuration config_old to config_new" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "999" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "DHCP Relay Enabled", + "message": "admin has copied switch configuration config_old to config_new", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-21T18:32:07.025548-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "DHCPD" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "rest": { + "dns": "8.8.4.4", + "dns_nameserver": "8.8.8.8" } }, "ecs": { @@ -11491,33 +14520,33 @@ "category": [ "network" ], - "code": "3402", - "original": "2024-06-21T18:32:07.025548-05:00 8360-Primaire dhcpd[999]: Event|3402|LOG_INFO|DHCPD|-|DHCP Relay Disabled" + "code": "4615", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4615|LOG_INFO|REST|-|admin has configured 8.8.8.8 DNS nameserver to 8.8.4.4" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "dhcpd", - "procid": "999" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "DHCP Relay Disabled", + "message": "admin has configured 8.8.8.8 DNS nameserver to 8.8.4.4", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "IRDP" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -11527,33 +14556,33 @@ "category": [ "network" ], - "code": "3501", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-irdp[1234]: Event|3501|LOG_INFO|IRDP|-|IRDP enabled on interface eth0" + "code": "4616", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4616|LOG_INFO|REST|-|admin has deleted all DNS nameservers" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-irdp", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "IRDP enabled on interface eth0", + "message": "admin has deleted all DNS nameservers", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -11563,33 +14592,39 @@ "category": [ "network" ], - "code": "3901", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3901|LOG_INFO|IPV6ROUTER|-|ipv6 ra enabled on interface: eth0" + "code": "4617", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4617|LOG_INFO|REST|-|admin created http://www.example.com" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "ipv6 ra enabled on interface: eth0", + "message": "admin created http://www.example.com", "tags": [ "preserve_original_event" - ] + ], + "url": { + "original": "http://www.example.com" + }, + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "subscriber": "subscriber1" } }, "ecs": { @@ -11599,33 +14634,37 @@ "category": [ "network" ], - "code": "3902", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3902|LOG_INFO|IPV6ROUTER|-|ipv6 ra disabled on interface: eth0" + "code": "4621", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4621|LOG_INFO|REST|-|User: admin removed subscriber: subscriber1." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "ipv6 ra disabled on interface: eth0", + "message": "User: admin removed subscriber: subscriber1.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "subscriber": "subscriber1", + "subscription": "subscription1" } }, "ecs": { @@ -11635,17 +14674,17 @@ "category": [ "network" ], - "code": "3903", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3903|LOG_INFO|IPV6ROUTER|-|Disabled sending MTU in Router-Advertisement messages on eth0" + "code": "4623", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4623|LOG_INFO|REST|-|Subscriber: subscriber1 removed subscription: subscription1." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Disabled sending MTU in Router-Advertisement messages on eth0", + "message": "Subscriber: subscriber1 removed subscription: subscription1.", "tags": [ "preserve_original_event" ] @@ -11654,14 +14693,11 @@ "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -11671,17 +14707,17 @@ "category": [ "network" ], - "code": "3904", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3904|LOG_INFO|IPV6ROUTER|-|Enabled sending MTU in Router-Advertisement messages on eth0" + "code": "4624", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4624|LOG_WARN|REST|-|Unable to add new subscriber. Max number of subscribers has been reached." }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Enabled sending MTU in Router-Advertisement messages on eth0", + "message": "Unable to add new subscriber. Max number of subscribers has been reached.", "tags": [ "preserve_original_event" ] @@ -11690,14 +14726,14 @@ "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "subscriber": "subscriber1" } }, "ecs": { @@ -11707,33 +14743,33 @@ "category": [ "network" ], - "code": "3905", - "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3905|LOG_INFO|IPV6ROUTER|-|Disabled sending RDNSS in Router-Advertisement messages on eth0" + "code": "4625", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4625|LOG_WARN|REST|-|Unable to add new subscription. Max number of subscriptions for subscriber1 has been reached." }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Disabled sending RDNSS in Router-Advertisement messages on eth0", + "message": "Unable to add new subscription. Max number of subscriptions for subscriber1 has been reached.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "name": "script1" } }, "ecs": { @@ -11743,33 +14779,36 @@ "category": [ "network" ], - "code": "3906", - "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3906|LOG_INFO|IPV6ROUTER|-|Enabled sending RDNSS in Router-Advertisement messages on eth0" + "code": "4627", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4627|LOG_INFO|REST|-|NAE Script script1 has been deleted by user admin." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Enabled sending RDNSS in Router-Advertisement messages on eth0", + "message": "NAE Script script1 has been deleted by user admin.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "name": "agent1" } }, "ecs": { @@ -11779,33 +14818,36 @@ "category": [ "network" ], - "code": "3907", - "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3907|LOG_INFO|IPV6ROUTER|-|Disabled sending DNSSL in Router-Advertisement messages on eth0" + "code": "4629", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4629|LOG_INFO|REST|-|NAE Agent agent1 has been updated by user admin." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Disabled sending DNSSL in Router-Advertisement messages on eth0", + "message": "NAE Agent agent1 has been updated by user admin.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "name": "agent1" } }, "ecs": { @@ -11815,33 +14857,36 @@ "category": [ "network" ], - "code": "3908", - "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3908|LOG_INFO|IPV6ROUTER|-|Enabled sending DNSSL in Router-Advertisement messages on eth0" + "code": "4630", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4630|LOG_INFO|REST|-|NAE Agent agent1 has been deleted by user admin." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Enabled sending DNSSL in Router-Advertisement messages on eth0", + "message": "NAE Agent agent1 has been deleted by user admin.", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "command": "reboot" } }, "ecs": { @@ -11851,33 +14896,37 @@ "category": [ "network" ], - "code": "3909", - "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3909|LOG_INFO|IPV6ROUTER|-|Interface: eth0 is added to router discovery" + "code": "4631", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4631|LOG_ERR|REST|-|Error rebooting switch, reboot command: reboot, error received: timeout", + "reason": "timeout" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Interface: eth0 is added to router discovery", + "message": "Error rebooting switch, reboot command: reboot, error received: timeout", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "New York" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -11887,35 +14936,40 @@ "category": [ "network" ], - "code": "3910", - "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3910|LOG_INFO|IPV6ROUTER|-|Interface: eth0 is deleted from router discovery" + "code": "4632", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4632|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default with Source IP 192.168.1.1 has been successfully established." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Interface: eth0 is deleted from router discovery", + "message": "Connection to HPE Aruba Networking Central on location New York on VRF default with Source IP 192.168.1.1 has been successfully established.", + "source": { + "ip": "192.168.1.1" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:55:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "New York" }, - "len": 64 + "vrf": { + "id": "default" + } }, "ecs": { "version": "8.11.0" @@ -11924,38 +14978,40 @@ "category": [ "network" ], - "code": "3911", - "original": "2024-06-18T12:55:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3911|LOG_INFO|IPV6ROUTER|-|Added ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0" + "code": "4633", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4633|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Requesting new Aruba Central location from CLI/DHCP/Activate." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Added ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0", - "server": { - "ip": "FE80::C000:1DFF:FEE0:C01" + "message": "Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Requesting new Aruba Central location from CLI/DHCP/Activate.", + "source": { + "ip": "192.168.1.1" }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:56:38.182641-05:00", + "@timestamp": "2024-06-18T12:48:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "New York" }, - "len": 64 + "vrf": { + "id": "default" + } }, "ecs": { "version": "8.11.0" @@ -11964,38 +15020,40 @@ "category": [ "network" ], - "code": "3912", - "original": "2024-06-18T12:56:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3912|LOG_INFO|IPV6ROUTER|-|Deleted ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 from interface: eth0" + "code": "4634", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4634|LOG_INFO|REST|-|Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Trying to reconnect." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Deleted ipv6 prefix: FE80::C000:1DFF:FEE0:C01/64 from interface: eth0", - "server": { - "ip": "FE80::C000:1DFF:FEE0:C01" + "message": "Connection to HPE Aruba Networking Central on location New York on VRF default and Source IP 192.168.1.1 has been closed by Aruba Central. Trying to reconnect.", + "source": { + "ip": "192.168.1.1" }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:57:38.182641-05:00", + "@timestamp": "2024-06-18T12:49:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "San Francisco" }, - "prefix": "FE80::C000:1DFF:FEE0:C01/64" + "vrf": { + "id": "default" + } }, "ecs": { "version": "8.11.0" @@ -12004,35 +15062,40 @@ "category": [ "network" ], - "code": "3913", - "original": "2024-06-18T12:57:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3913|LOG_INFO|IPV6ROUTER|-|Added RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 to prefix list" + "code": "4635", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4635|LOG_INFO|REST|-|Received HPE Aruba Networking Central location San Francisco on VRF default with Source IP 192.168.1.2" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Added RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 to prefix list", + "message": "Received HPE Aruba Networking Central location San Francisco on VRF default with Source IP 192.168.1.2", + "source": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:58:38.182641-05:00", + "@timestamp": "2024-06-18T12:50:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "San Francisco" }, - "prefix": "FE80::C000:1DFF:FEE0:C01/64" + "vrf": { + "id": "default" + } }, "ecs": { "version": "8.11.0" @@ -12041,33 +15104,39 @@ "category": [ "network" ], - "code": "3914", - "original": "2024-06-18T12:58:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3914|LOG_INFO|IPV6ROUTER|-|Deleted RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 from prefix list" + "code": "4636", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4636|LOG_INFO|REST|-|Received new HPE Aruba Networking Central location. Closing existing connection with Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Deleted RA Prefix: FE80::C000:1DFF:FEE0:C01/64 on interface: eth0 from prefix list", + "message": "Received new HPE Aruba Networking Central location. Closing existing connection with Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2.", + "source": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:59:38.182641-05:00", + "@timestamp": "2024-06-18T12:51:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "San Francisco" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12077,33 +15146,33 @@ "category": [ "network" ], - "code": "3915", - "original": "2024-06-18T12:59:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3915|LOG_INFO|IPV6ROUTER|-|default prefix is configured on interface eth0" + "code": "4637", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4637|LOG_ERR|REST|-|Internal error. Closing connection to Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2." }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "default prefix is configured on interface eth0", + "message": "Internal error. Closing connection to Aruba Central on location San Francisco on VRF default with Source IP 192.168.1.2.", + "source": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T13:00:38.182641-05:00", + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -12113,33 +15182,36 @@ "category": [ "network" ], - "code": "3916", - "original": "2024-06-18T13:00:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3916|LOG_INFO|IPV6ROUTER|-|RDNSS is added on interface: eth0" + "code": "4638", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4638|LOG_INFO|REST|-|Waiting for HPE Aruba Networking Central location from CLI/DHCP/Aruba Activate Server." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "RDNSS is added on interface: eth0", + "message": "Waiting for HPE Aruba Networking Central location from CLI/DHCP/Aruba Activate Server.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:53:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "San Francisco" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12149,33 +15221,39 @@ "category": [ "network" ], - "code": "3917", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3917|LOG_INFO|IPV6ROUTER|-|RDNSS is deleted on interface: eth0" + "code": "4639", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4639|LOG_INFO|REST|-|Connecting to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "RDNSS is deleted on interface: eth0", + "message": "Connecting to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2.", + "source": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "interface": { - "id": "eth0" + "rest": { + "central_location": "San Francisco" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12185,33 +15263,33 @@ "category": [ "network" ], - "code": "3918", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3918|LOG_INFO|IPV6ROUTER|-|DNSSL is added on interface: eth0" + "code": "4640", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4640|LOG_ERR|REST|-|Failed to connect to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "DNSSL is added on interface: eth0", + "message": "Failed to connect to HPE Aruba Networking Central on location San Francisco on VRF default with Source IP 192.168.1.2", + "source": { + "ip": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "IPV6ROUTER" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "interface": { - "id": "eth0" } }, "ecs": { @@ -12221,33 +15299,36 @@ "category": [ "network" ], - "code": "3919", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-ipv6ra[1234]: Event|3919|LOG_INFO|IPV6ROUTER|-|DNSSL is deleted on interface: eth0" + "code": "4641", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4641|LOG_INFO|REST|-|HPE Aruba Networking Central is disabled." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-ipv6ra", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "DNSSL is deleted on interface: eth0", + "message": "HPE Aruba Networking Central is disabled.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "MULTICAST" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "limit": { - "threshold": "100" + "rest": { + "central_location": "New York" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12257,34 +15338,33 @@ "category": [ "network" ], - "code": "4001", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-multicast[1234]: Event|4001|LOG_WARN|MULTICAST|-|The Multicast L3 Bridge Control Forwarding entries limit was reached: 100" + "code": "4642", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4642|LOG_INFO|REST|-|HPE Aruba Networking Central is disabled. Closing connection to Aruba Central on location New York on VRF default with Source IP 192.168.1.1" }, "log": { - "level": "LOG_WARN", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-multicast", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "The Multicast L3 Bridge Control Forwarding entries limit was reached: 100", + "message": "HPE Aruba Networking Central is disabled. Closing connection to Aruba Central on location New York on VRF default with Source IP 192.168.1.1", + "source": { + "ip": "192.168.1.1" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "PROXYARP" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" - }, - "port": "eth0", - "vrf": { - "id": "vrf1" } }, "ecs": { @@ -12294,34 +15374,33 @@ "category": [ "network" ], - "code": "4205", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4205|LOG_INFO|PROXYARP|-|Local proxy ARP enabled for port eth0 on vrf vrf1" + "code": "4643", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4643|LOG_INFO|REST|-|HPE Aruba Networking Central is enabled." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-arp", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Local proxy ARP enabled for port eth0 on vrf vrf1", + "message": "HPE Aruba Networking Central is enabled.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "PROXYARP" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0", - "vrf": { - "id": "vrf1" + "rest": { + "operation": "POST" } }, "ecs": { @@ -12331,34 +15410,33 @@ "category": [ "network" ], - "code": "4206", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4206|LOG_INFO|PROXYARP|-|Local proxy ARP disabled for port eth0 on vrf vrf1" + "code": "4652", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4652|LOG_WARN|REST|-|Central connected, any config change through rest POST operation may not be persistent. If central reapplies the config, change can be overwritten" }, "log": { - "level": "LOG_INFO", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-arp", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Local proxy ARP disabled for port eth0 on vrf vrf1", + "message": "Central connected, any config change through rest POST operation may not be persistent. If central reapplies the config, change can be overwritten", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "PROXYARP" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0", - "vrf": { - "id": "vrf1" + "rest": { + "mode": "read-only" } }, "ecs": { @@ -12368,34 +15446,36 @@ "category": [ "network" ], - "code": "4207", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4207|LOG_ERR|PROXYARP|-|Failed to enable local proxy ARP for port eth0 on vrf vrf1" + "code": "4653", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4653|LOG_INFO|REST|-|User admin has configured read-only for configuration lockout" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-arp", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Failed to enable local proxy ARP for port eth0 on vrf vrf1", + "message": "User admin has configured read-only for configuration lockout", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "admin" + } }, { - "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "PROXYARP" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "port": "eth0", - "vrf": { - "id": "vrf1" + "rest": { + "mode": "enabled" } }, "ecs": { @@ -12405,39 +15485,33 @@ "category": [ "network" ], - "code": "4208", - "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire hpe-arp[1234]: Event|4208|LOG_ERR|PROXYARP|-|Failed to disable local proxy ARP for port eth0 on vrf vrf1" + "code": "4654", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4654|LOG_INFO|REST|-|HPE Aruba Networking Central support mode is enabled for a vtysh session" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-arp", + "appname": "hpe-rest", "procid": "1234" } }, - "message": "Failed to disable local proxy ARP for port eth0 on vrf vrf1", + "message": "HPE Aruba Networking Central support mode is enabled for a vtysh session", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2023-11-30T11:09:33.733026-05:00", - "_temp": {}, + "@timestamp": "2024-06-18T12:52:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmt": { - "config_err": { - "default_gateway": "127.0.0.1", - "domain_name": "", - "hostname": "8360-ServerName", - "ip": "127.0.0.1" - } + "vrf": { + "id": "default" } }, "ecs": { @@ -12447,33 +15521,40 @@ "category": [ "network" ], - "code": "4302", - "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4302|LOG_INFO|AMM|-|MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}]" + "code": "4649", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4649|LOG_ERR|REST|-|Unable to sync switch time with Aruba Activate Server 192.168.1.2 via VRF default." }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "ops_mgmtintfcfg", - "procid": "3485" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}]", + "message": "Unable to sync switch time with Aruba Activate Server 192.168.1.2 via VRF default.", + "server": { + "address": "192.168.1.2" + }, "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2023-11-30T11:09:33.733026-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmt": { - "config_err": "Link state is down." + "rest": { + "central_location": "South Africa", + "central_source": "DHCP" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12483,39 +15564,37 @@ "category": [ "network" ], - "code": "4302", - "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4302|LOG_INFO|AMM|-|MGMT_INTF: Link state is down." + "code": "4650", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4650|LOG_INFO|REST|-|Unable to fetch HPE Aruba Networking Central location South Africa from DHCP via VRF default." }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "ops_mgmtintfcfg", - "procid": "3485" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "MGMT_INTF: Link state is down.", + "message": "Unable to fetch HPE Aruba Networking Central location South Africa from DHCP via VRF default.", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2023-11-30T11:09:33.733026-05:00", - "_temp": {}, + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "mgmt": { - "config_crit": { - "default_gateway": "127.0.0.1", - "domain_name": "", - "hostname": "8360-ServerName", - "ip": "127.0.0.1" - } + "rest": { + "central_location": "San Francisco", + "central_source": "DHCP" + }, + "vrf": { + "id": "default" } }, "ecs": { @@ -12525,36 +15604,33 @@ "category": [ "network" ], - "code": "4303", - "original": "2023-11-30T11:09:33.733026-05:00 8360-Primaire ops_mgmtintfcfg[3485]: Event|4303|LOG_INFO|AMM|-|MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}] is updated in ovsdb." + "code": "4651", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4651|LOG_INFO|REST|-|HPE Aruba Networking Central location San Francisco successfully fetched from DHCP via VRF default" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "ops_mgmtintfcfg", - "procid": "3485" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "MGMT_INTF: Static parameter : [{\"ip\": \"127.0.0.1\", \"hostname\": \"8360-ServerName\", \"domain_name\": \"\", \"default_gateway\": \"127.0.0.1\"}] is updated in ovsdb.", + "message": "HPE Aruba Networking Central location San Francisco successfully fetched from DHCP via VRF default", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-20T14:00:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", - "firmware": { - "after": "1.1.0", - "before": "1.0.0", - "dnld_type": "TFTP", - "image_profile": "primary" - }, "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "identity_1" } }, "ecs": { @@ -12564,20 +15640,17 @@ "category": [ "network" ], - "code": "4401", - "original": "2024-06-20T14:00:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4401|LOG_INFO|AMM|-|User admin: primary image updated via TFTP from 192.168.1.1. Firmware version, Before Update: 1.0.0 After Update: 1.1.0" + "code": "4655", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4655|LOG_INFO|REST|-|User admin logged in from identity_1 through REST session" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "User admin: primary image updated via TFTP from 192.168.1.1. Firmware version, Before Update: 1.0.0 After Update: 1.1.0", - "source": { - "address": "192.168.1.1" - }, + "message": "User admin logged in from identity_1 through REST session", "tags": [ "preserve_original_event" ], @@ -12586,20 +15659,17 @@ } }, { - "@timestamp": "2024-06-20T14:01:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", - "firmware": { - "after": "1.1.0", - "before": "1.0.0", - "dnld_type": "USB", - "image_profile": "secondary" - }, "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "identity_1" } }, "ecs": { @@ -12609,17 +15679,17 @@ "category": [ "network" ], - "code": "4402", - "original": "2024-06-20T14:01:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4402|LOG_INFO|AMM|-|User admin: secondary image updated via USB. Firmware version, Before Update: 1.0.0 After Update: 1.1.0" + "code": "4656", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4656|LOG_ERR|REST|-|User admin login from identity_1 for REST session has failed" }, "log": { - "level": "LOG_INFO", + "level": "LOG_ERR", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "User admin: secondary image updated via USB. Firmware version, Before Update: 1.0.0 After Update: 1.1.0", + "message": "User admin login from identity_1 for REST session has failed", "tags": [ "preserve_original_event" ], @@ -12628,18 +15698,17 @@ } }, { - "@timestamp": "2024-06-20T14:02:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", - "firmware": { - "dnld_type": "TFTP", - "image_profile": "primary" - }, "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "identity_1" } }, "ecs": { @@ -12649,20 +15718,17 @@ "category": [ "network" ], - "code": "4403", - "original": "2024-06-20T14:02:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4403|LOG_ERR|AMM|-|User admin: primary image update failed via TFTP from 192.168.1.1" + "code": "4657", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4657|LOG_INFO|REST|-|User admin logged out of REST session from identity_1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "User admin: primary image update failed via TFTP from 192.168.1.1", - "source": { - "address": "192.168.1.1" - }, + "message": "User admin logged out of REST session from identity_1", "tags": [ "preserve_original_event" ], @@ -12671,18 +15737,17 @@ } }, { - "@timestamp": "2024-06-20T14:03:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", - "firmware": { - "dnld_type": "USB", - "image_profile": "secondary" - }, "hardware": { "device": "8360-Primaire" + }, + "rest": { + "identity": "identity_1" } }, "ecs": { @@ -12692,17 +15757,17 @@ "category": [ "network" ], - "code": "4404", - "original": "2024-06-20T14:03:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4404|LOG_ERR|AMM|-|User admin: secondary image update failed via USB" + "code": "4658", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4658|LOG_WARN|REST|-|REST session from identity_1 with User admin is rejected because maximum session limit is reached" }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "User admin: secondary image update failed via USB", + "message": "REST session from identity_1 with User admin is rejected because maximum session limit is reached", "tags": [ "preserve_original_event" ], @@ -12711,14 +15776,17 @@ } }, { - "@timestamp": "2024-06-20T14:04:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "vrf": { + "name": "default" } }, "ecs": { @@ -12728,30 +15796,33 @@ "category": [ "network" ], - "code": "4405", - "original": "2024-06-20T14:04:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4405|LOG_ERR|AMM|-|Firmware image signature not valid" + "code": "4660", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4660|LOG_INFO|REST|-|REST server is enabled on VRF default" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "Firmware image signature not valid", + "message": "REST server is enabled on VRF default", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-20T14:05:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "vrf": { + "name": "default" } }, "ecs": { @@ -12761,32 +15832,38 @@ "category": [ "network" ], - "code": "4406", - "original": "2024-06-20T14:05:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4406|LOG_ERR|AMM|-|Firmware image is not compatible with hardware" + "code": "4661", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4661|LOG_INFO|REST|-|REST server is disabled on VRF default" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "Firmware image is not compatible with hardware", + "message": "REST server is disabled on VRF default", "tags": [ "preserve_original_event" ] }, { - "@timestamp": "2024-06-20T14:06:38.324517-05:00", + "@timestamp": "2024-06-18T12:54:38.182641-05:00", "aruba": { "component": { - "category": "AMM" + "category": "REST" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" + }, + "interface": { + "id": "interface1" } }, + "client": { + "ip": "127.0.0.1" + }, "ecs": { "version": "8.11.0" }, @@ -12794,20 +15871,23 @@ "category": [ "network" ], - "code": "4407", - "original": "2024-06-20T14:06:38.324517-05:00 8360-Primaire hpe-firmware[1989034]: Event|4407|LOG_ERR|AMM|-|Firmware image is invalid" + "code": "4662", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire hpe-rest[1234]: Event|4662|LOG_INFO|REST|-|User satori login from 127.0.0.1 for REST session has failed since the user is trying to login through an interface which is not allowed. Allowed interfaces are: interface1" }, "log": { - "level": "LOG_ERR", + "level": "LOG_INFO", "syslog": { - "appname": "hpe-firmware", - "procid": "1989034" + "appname": "hpe-rest", + "procid": "1234" } }, - "message": "Firmware image is invalid", + "message": "User satori login from 127.0.0.1 for REST session has failed since the user is trying to login through an interface which is not allowed. Allowed interfaces are: interface1", "tags": [ "preserve_original_event" - ] + ], + "user": { + "name": "satori" + } }, { "@timestamp": "2024-06-18T12:45:38.182641-05:00", diff --git a/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 054de95c357..1de4aad9b70 100644 --- a/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -368,6 +368,120 @@ processors: patterns: - "^Loopback Interface %{DATA:aruba.interface.id}, (created|deleted|configured administratively %{GREEDYDATA:aruba.interface.state})" + # sFlow events (10xx) + # https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SFLOW.htm + - grok: + field: message + tag: sflow_event_1001_1002_1003 + description: "Log a failure when trying to start/stop/restart host sFlow daemon | read/write to host sFlow configuration file | trying to configure sFlow on SIM OVS" + if: "['1001','1002','1003'].contains(ctx.event?.code)" + patterns: + - "^Failed to %{DATA:aruba.sflow.operation} host sFlow (agent|configuration file %{DATA:file.name}): %{GREEDYDATA:event.reason}" + - "^Failed to %{DATA:aruba.sflow.operation} sFlow configuration from bridge %{DATA:aruba.sflow.bridge}: %{GREEDYDATA:event.reason}" + - dissect: + field: message + tag: sflow_event_1005 + description: "Log a failure when trying to add/delete an iptable rule for sFlow." + if: "ctx.event?.code == '1005'" + pattern: "Failed to %{aruba.sflow.operation} %{aruba.sflow.chain} iptable rules for %{aruba.port}: %{event.reason}" + - dissect: + field: message + tag: sflow_event_1008 + description: "Logs an error if an interface does not have a netdev class." + if: "ctx.event?.code == '1008'" + pattern: "Unable to get netdev for interface %{aruba.interface.id}" + - dissect: + field: message + tag: sflow_event_1010 + description: "Logs an error if sFlow KNET filter creation fails." + if: "ctx.event?.code == '1010'" + pattern: "Failed to create KNET filter for: %{aruba.error.description}" + - grok: + field: message + tag: sflow_event_1014_1015 + description: "Logs an error if sFlow is enabled/disabled on an invalid port | if sFlow sampler is missing on a port" + if: "['1014','1015'].contains(ctx.event?.code)" + patterns: + - "port: %{GREEDYDATA:aruba.port}" + - grok: + field: message + tag: sflow_event_1004_1017 + description: "Log a failure when trying to delete all iptable rules added for sFlow | if port configuration is not available" + if: "['1004','1017'].contains(ctx.event?.code)" + patterns: + - ": %{GREEDYDATA:event.reason}" + - grok: + field: message + tag: sflow_event_1018_1019 + description: "Logs an error if (getting|setting) a sampling rate on a port fails." + if: "['1018','1019'].contains(ctx.event?.code)" + patterns: + - "^Failed to (get|set) sampling rate on port %{DATA:aruba.port}: %{GREEDYDATA:event.reason}" + - grok: + field: message + tag: sflow_event_1020_1021 + description: "Logs an error in case of invalid agent interface IP address configuration | invalid collector IP address configuration." + if: "['1020','1021'].contains(ctx.event?.code)" + patterns: + - "IP address: %{IP:client.ip}" + - dissect: + field: message + tag: sflow_event_1022 + description: "Logs an error if unable to retrieve interface statistics." + if: "ctx.event?.code == '1022'" + pattern: "Failed to get interface statistics for unit %{aruba.unit} port %{aruba.port}: %{event.reason}" + - dissect: + field: message + tag: sflow_event_1025 + description: "Logs a change in sFlow sampling rate." + if: "ctx.event?.code == '1025'" + pattern: "Changed sFlow sampling rate from %{aruba.sflow.old_rate} to %{aruba.sflow.new_rate}." + - grok: + field: message + tag: sflow_event_1026 + description: "Logs sFlow agents header length event." + if: "ctx.event?.code == '1026'" + patterns: + - "Set sFlow agents header len to %{NUMBER:aruba.len:long}." + - grok: + field: message + tag: sflow_event_1027 + description: "Logs sFlow agents header length event." + if: "ctx.event?.code == '1027'" + patterns: + - "^Set sFlow agents IP to %{IP:client.ip}." + - grok: + field: message + tag: sflow_event_1028 + description: "Log setting max datagram size on sFlow agent." + if: "ctx.event?.code == '1028'" + patterns: + - "^Set max datagram size on sFlow agent to %{NUMBER:aruba.sflow.dgramsize:long}." + - dissect: + field: message + tag: sflow_event_1029 + description: "Add sFlow poller on a port" + if: "ctx.event?.code == '1029'" + pattern: "Add sFlow poller on %{aruba.port} with ifIndex %{aruba.interface.id} at interval %{aruba.sflow.intvl}." + - dissect: + field: message + tag: sflow_event_1030 + description: "Delete sFlow poller on a port." + if: "ctx.event?.code == '1030'" + pattern: "Remove sFlow poller on%{aruba.interface.id}." + - dissect: + field: message + tag: sflow_event_1031 + description: "Set polling interval for sFlow agent." + if: "ctx.event?.code == '1031'" + pattern: "Set polling interval of %{aruba.sflow.intvl} on sFlow agent." + - dissect: + field: message + tag: sflow_event_1032 + description: "Logs change in sFlow mode." + if: "ctx.event?.code == '1032'" + pattern: "sFlow sampling mode set to %{aruba.sflow.mode}." + # LACP events (13xx) # https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/LACP.htm - grok: @@ -1167,6 +1281,183 @@ processors: patterns: - "^User %{DATA:user.name}: %{DATA:aruba.firmware.image_profile} image update failed via %{DATA:aruba.firmware.dnld_type}( from %{HOSTNAME:source.address})?$" + # Self Test events (450x) + # https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SELFTEST.htm + - grok: + if: "['4501','4502'].contains(ctx.event?.code)" + tag: self_test_event_4501_4502 + field: "message" + description: "logs the [started|completion] of selftest on a particular subsystem" + patterns: + - "^Selftest has (started|completed) on subsystem %{GREEDYDATA:aruba.subsystem}" + - dissect: + if: "ctx.event?.code == '4503'" + tag: self_test_event_4503 + field: "message" + description: "logs the selftest failure of a particular subsystem" + pattern: "Selftest has failed on subsystem %{aruba.subsystem} with error code %{event.reason}" + - dissect: + if: "ctx.event?.code == '4504'" + tag: self_test_event_4504 + field: "message" + description: "logs the port selftest failure on a given subsystem" + pattern: 'Selftest has failed on %{aruba.self_test.stack}/%{aruba.slot}/%{aruba.interface.id} with error code %{event.reason}' + +# REST events (46xx) +# https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/RESTD.htm + - grok: + if: "['4601','4602'].contains(ctx.event?.code)" + tag: rest_event_4601_4602 + field: "message" + description: "logs a [failed|successful] authentication attempt of a user via REST" + patterns: + - "^Authentication (failed|succeeded) for user %{DATA:user.name} in session %{GREEDYDATA:aruba.session.id}" + - dissect: + if: "ctx.event?.code == '4603'" + tag: rest_event_4603 + field: "message" + description: "logs an authorization configuration conflict" + pattern: 'Conflict in authorization configuration. Existing config::URL(%{aruba.rest.match}), type(%{aruba.rest.type}) New config::(%{url.original}), type(%{aruba.rest.autztype})' + - grok: + if: "['4606','4607','4608'].contains(ctx.event?.code)" + tag: rest_event_4606_4607_4608 + field: "message" + description: "logs a [failed|successful|allowed] authorization attempt of a user via REST " + patterns: + - "^Authorization (failed|succeeded|allowed) for user %{DATA:user.name}, for resource %{DATA:aruba.rest.resource}, with action %{GREEDYDATA:event.action}" + - dissect: + if: "ctx.event?.code == '4609'" + tag: rest_event_4609 + field: "message" + description: "logs a successful add of a user via REST" + pattern: "User %{user.name} added %{aruba.rest.added_user} with role %{aruba.role}" + - grok: + if: "['4610','4653'].contains(ctx.event?.code)" + tag: rest_event_4610_4653 + field: "message" + description: "logs a successful deletion of a user via REST | Logs a message when a user changes the REST configuration lockout mode" + patterns: + - "^User %{DATA:user.name} deleted %{GREEDYDATA:aruba.rest.deleted_user}" + - "^User %{DATA:user.name} has configured %{DATA:aruba.rest.mode} for configuration lockout" + - grok: + if: "['4611','4612'].contains(ctx.event?.code)" + tag: rest_event_4611_4612 + field: "message" + description: "logs a [unsuccessful|successful] password change for a user via REST" + patterns: + - "^User %{DATA:user.name} (successfully changed password|password change failed)" + - grok: + if: "['4613','4614','4615','4616'].contains(ctx.event?.code)" + tag: rest_event_4613_4614_4615_4616 + field: "message" + description: "logs a success config write operation | success copy of saved | success when the nameserver is written to ovsdb | success when the nameserver is deleted from ovsdb" + patterns: + - "%{USER_PATTERN} written a new switch configuration to %{GREEDYDATA:aruba.rest.config_name}" + - "%{USER_PATTERN} copied switch configuration %{DATA:aruba.rest.config_from_name} to %{GREEDYDATA:aruba.rest.config_to_name}" + - "%{USER_PATTERN} configured %{DATA:aruba.rest.dns_nameserver} DNS nameserver to %{GREEDYDATA:aruba.rest.dns}" + - "%{USER_PATTERN} deleted all DNS nameservers" + pattern_definitions: + USER_PATTERN: "^%{DATA:user.name} has" + - grok: + if: "['4617','4618','4619'].contains(ctx.event?.code)" + tag: rest_event_4617_4618_4619 + field: "message" + description: "A user has successfully [created|deleted|modified] a new resource in OVSDB" + patterns: + - "^%{DATA:user.name} (created|deleted|modified)( %{GREEDYDATA:url.original})?" + - grok: + if: "['4620','4621'].contains(ctx.event?.code)" + tag: rest_event_4620_4621 + field: "message" + description: "A user has [added|removed] new notification subscriber" + patterns: + - "^User: %{DATA:user.name} (added|removed) subscriber: %{GREEDYDATA:aruba.rest.subscriber}." + - grok: + if: "['4622','4623','4625'].contains(ctx.event?.code)" + tag: rest_event_4622_4623_4625 + field: "message" + description: "A subscriber has [added|removed] new subscription | Unable to add new subscription as max number reached for the specified subscriber" + patterns: + - "^Subscriber: %{DATA:aruba.rest.subscriber} (added|removed) subscription: %{GREEDYDATA:aruba.rest.subscription}." + - "^Unable to add new subscription. Max number of subscriptions for %{DATA:aruba.rest.subscriber} has been reached." + - grok: + if: "['4626','4627','4628','4629','4630','4631'].contains(ctx.event?.code)" + tag: rest_event_4626_4627_4628_4629_4630_4631 + field: "message" + description: "NAE [Script|Agent] has been [created|deleted] successfully | Logs an error if a reboot fails" + patterns: + - "^NAE (Script|Agent) %{DATA:aruba.rest.name} has been (created|updated|deleted) by user %{GREEDYDATA:user.name}." + - "^Error rebooting switch, reboot command: %{DATA:aruba.rest.command}, error received: %{GREEDYDATA:event.reason}" + - grok: + if: "['4632','4633','4634','4635','4636','4637','4639','4640','4642'].contains(ctx.event?.code)" + tag: rest_event_4632_4633_4634_4635_4636_4637_4639_4640_4642 + field: "message" + description: "HPE Aruba Networking Central type logs" + patterns: + - "location %{DATA:aruba.rest.central_location} on VRF %{DATA:aruba.vrf.id} (with|and) Source IP %{IP:source.ip}" + - grok: + if: "['4645','4649'].contains(ctx.event?.code)" + tag: rest_event_4645_4649 + field: "message" + description: "Aruba Activate server is reachable via an active VRF | Unable to sync switch time with Aruba Activate Server" + patterns: + - "(S|s)erver %{DATA:server.address}( is reachable)? via VRF %{GREEDYDATA:aruba.vrf.id}." + - grok: + if: "['4646','4648'].contains(ctx.event?.code)" + tag: rest_event_4646_4648 + field: "message" + description: "Aruba Activate server is not reachable through any supported VRF | Switch time is synced with Aruba Activate Server" + patterns: + - "server %{DATA:server.address} " + - "Server %{GREEDYDATA:server.address}." + - grok: + if: "['4650', '4651'].contains(ctx.event?.code)" + tag: rest_event_4650_4651 + field: "message" + description: "(Unable|Successfully) to fetch HPE Aruba Networking Central location from Central Source (CLI/DHCP/Aruba Activate Server)" + patterns: + - "location( %{DATA:aruba.rest.central_location})? successfully fetched from %{DATA:aruba.rest.central_source} via VRF( %{GREEDYDATA:aruba.vrf.id})?" + - "location( %{DATA:aruba.rest.central_location})? from %{DATA:aruba.rest.central_source} via VRF( %{GREEDYDATA:aruba.vrf.id})?." + - grok: + if: "ctx.event?.code == '4652'" + tag: rest_event_4652 + field: "message" + description: "Central connected, any config change through rest may not be persistent, Central can overwrite the change" + patterns: + - "Central connected, any config change through rest %{DATA:aruba.rest.operation} operation may not be persistent. If central reapplies the config, change can be overwritten" + - grok: + if: "ctx.event?.code == '4654'" + tag: rest_event_4654 + field: "message" + description: "Logs a message when a HPE Aruba Networking Central support mode is enabled or disabled" + patterns: + - "support mode is %{DATA:aruba.rest.mode} for a vtysh session" + - grok: + if: "['4655','4656','4657'].contains(ctx.event?.code)" + tag: rest_event_4655_4656_4657 + field: "message" + description: "Logs a message when a user login is [successful|failed] | Logs a message when a user logs out of a session" + patterns: + - "^User %{DATA:user.name} (logged in|login) from %{DATA:aruba.rest.identity} " + - "^User %{DATA:user.name} logged out of REST session from %{GREEDYDATA:aruba.rest.identity}" + - grok: + if: "['4658','4659'].contains(ctx.event?.code)" + tag: rest_event_4658_4659 + field: "message" + description: "Logs a message when a user tries to login while maximum number of sessions are reached | when a REST session timed out due to the session being idle" + patterns: + - "^REST session from %{DATA:aruba.rest.identity} with User %{DATA:user.name} is rejected because maximum session limit is reached" + - "^%{DATA:user_agent.name:} session from %{DATA:aruba.rest.identity} with User %{DATA:user.name} timed out due to idle timeout" + - grok: + if: "['4660','4661','4662'].contains(ctx.event?.code)" + tag: rest_event_4660_4661_4662 + field: "message" + description: "Logs a message when the REST server is [enabled|disabled] on a VRF | when a user login fails since the access through this management interface is not allowed" + patterns: + - "^REST server is (enabled|disabled) on VRF %{GREEDYDATA:aruba.vrf.name}" + - "^User %{DATA:user.name} login from %{IP:client.ip} for REST session has failed since the user is trying to login through an interface which is not allowed. Allowed interfaces are: %{GREEDYDATA:aruba.interface.id}" + + # MAC Learning events (480x) # https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MAC-LEARN.htm - grok: diff --git a/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml b/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml index 0a2534e631f..e8f549872c7 100644 --- a/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml +++ b/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml @@ -951,6 +951,69 @@ - name: mgmt_module type: keyword description: "" + - name: rest + type: group + fields: + - name: added_user + type: keyword + description: "" + - name: autztype + type: keyword + description: "" + - name: central_location + type: keyword + description: "" + - name: central_source + type: keyword + description: "" + - name: command + type: keyword + description: "" + - name: config_name + type: keyword + description: "" + - name: config_from_name + type: keyword + description: "" + - name: config_to_name + type: keyword + description: "" + - name: deleted_user + type: keyword + description: "" + - name: dns_nameserver + type: keyword + description: "" + - name: dns + type: keyword + description: "" + - name: identity + type: keyword + description: "" + - name: match + type: keyword + description: "" + - name: mode + type: keyword + description: "" + - name: name + type: keyword + description: "" + - name: operation + type: keyword + description: "" + - name: resource + type: keyword + description: "" + - name: subscriber + type: keyword + description: "" + - name: subscription + type: keyword + description: "" + - name: type + type: keyword + description: "" - name: role type: keyword description: "" @@ -984,6 +1047,12 @@ - name: pvid type: keyword description: "" + - name: self_test + type: group + fields: + - name: stack + type: keyword + description: "" - name: sequence type: keyword description: "" @@ -1005,6 +1074,33 @@ - name: name type: keyword description: "" + - name: sflow + type: group + fields: + - name: bridge + type: keyword + description: "" + - name: chain + type: keyword + description: "" + - name: dgramsize + type: long + description: "" + - name: intvl + type: keyword + description: "" + - name: mode + type: keyword + description: "" + - name: new_rate + type: keyword + description: "" + - name: old_rate + type: keyword + description: "" + - name: operation + type: keyword + description: "" - name: slot type: long description: "" diff --git a/packages/hpe_aruba_cx/docs/README.md b/packages/hpe_aruba_cx/docs/README.md index eaf21dd76e1..6932433fc17 100644 --- a/packages/hpe_aruba_cx/docs/README.md +++ b/packages/hpe_aruba_cx/docs/README.md @@ -992,67 +992,78 @@ Note: Descriptions have not been filled out |------------|------------------------------| | | aruba.instance.id | -#### [REST events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/RESTD.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.rest.action | | | event.action | -| aruba.rest.activate_address | | | server.address | -| aruba.rest.added_user | | | | -| aruba.rest.added_user_role | | | aruba.role | -| aruba.rest.agent_name | | | agent.name | -| aruba.rest.autztype | | | | -| aruba.rest.central_location | | | server.address | -| aruba.rest.reboot_command | | | | -| aruba.rest.config_from_name | | | | -| aruba.rest.config_to_name | | | | -| aruba.rest.deleted_user | | | | -| aruba.rest.dns | | | | -| aruba.rest.dns_nameserver | | | dns.id | -| aruba.rest.error | | | error.message | -| aruba.rest.match | | | | -| aruba.rest.mode | | | | -| aruba.rest.resource | | | | -| aruba.rest.rest_operation | | | | -| aruba.rest.script_name | | | | -| aruba.rest.sessionid | | | | -| aruba.rest.source_ip | | | source.ip | -| aruba.rest.subscriber | | | | -| aruba.rest.subscription | | | | -| aruba.rest.config_value | | | | -| aruba.rest.uri | | | url.full | -| aruba.rest.url | | | url.full | -| aruba.rest.user | | | user.name | -| aruba.rest.vrf | | | aruba.vrf.id | - -#### [Self Test events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SELFTEST.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.self_test.error | | | error.message | -| aruba.self_test.interface | | | | -| aruba.self_test.slot | | | aruba.slot | -| aruba.self_test.stack | | | | -| aruba.self_test.subsystem | | | aruba.subsystem | +#### [REST events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/RESTD.htm) +| Docs Field | Schema Mapping | +|----------------------|----------------------------| +| `` | event.action | +| `` | aruba.rest.activate_address| +| `` | aruba.rest.added_user | +| `` | aruba.role | +| `` | aruba.rest.autztype | +| `` | aruba.rest.central_location| +| `` | aruba.rest.central_source | +| `` | aruba.rest.command | +| `` | aruba.rest.config_name | +| `` | aruba.rest.deleted_user | +| `` | aruba.rest.ip | +| `` | aruba.rest.dns_nameserver | +| `` | event.reason | +| `` | aruba.rest.config_from_name| +| `` | aruba.rest.identity | +| `` | client.ip | +| `` | aruba.rest.match | +| `` | aruba.interface.id | +| `` | aruba.rest.mode | +| `` | aruba.rest.name | +| `` | aruba.rest.resource | +| `` | aruba.rest.operation | +| `` | aruba.session.id | +| `` | source.ip | +| `` | aruba.rest.subscriber | +| `` | aruba.rest.subscription | +| `` | aruba.rest.config_to_name | +| `` | url.original | +| `` | url.original | +| `` | user.name | +| `` | aruba.vrf.id | +| `` | aruba.vrf.name | +| `` | aruba.rest.type | + +#### [Self Test events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SELFTEST.htm) +| Docs Field | Schema Mapping | +|--------------|-----------------------------| +| ``| aruba.interface.id | +| `` | aruba.slot | +| `` | aruba.self_test.stack | +| ``| aruba.subsystem | +| `` | event.reason | + +#### [Self Test Monitor events](https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/SelfTestMonitor.htm) +| Docs Field | Schema Mapping | +|--------------|-----------------------------| #### [sFlow events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SFLOW.htm) -| Field | Description | Type | Common | -|---------------------------|-------------|------|------------------------------| -| aruba.sflow.bridge | | | | -| aruba.sflow.chain | | | | -| aruba.sflow.desc | | | | -| aruba.sflow.dgramsize | | | | -| aruba.sflow.error | | | error.message | -| aruba.sflow.file | | | file.name | -| aruba.sflow.hdrlen | | | aruba.len | -| aruba.sflow.ifIndex | | | observer.ingress.interface.id| -| aruba.sflow.intvl | | | | -| aruba.sflow.ip_address | | | destination.ip | -| aruba.sflow.mode | | | | -| aruba.sflow.new_rate | | | | -| aruba.sflow.old_rate | | | | -| aruba.sflow.operation | | | event.action | -| aruba.sflow.port | | | server.port | -| aruba.sflow.port_name | | | server.port | -| aruba.sflow.unit | | | aruba.unit | +| Docs Field | Schema Mapping | +|-------------------|--------------------------------------------| +| `` | aruba.sflow.bridge | +| `` | aruba.sflow.chain | +| `` | aruba.error.description | +| `` | aruba.sflow.dgramsize | +| `` | event.reason | +| `` | file.name | +| `` | aruba.len | +| `` | aruba.interface.id | +| `` | aruba.interface.id | +| `` | aruba.sflow.intvl | +| `` | client.ip | +| `` | client.ip | +| `` | aruba.sflow.mode | +| `` | aruba.sflow.new_rate | +| `` | aruba.sflow.old_rate | +| `` | aruba.sflow.operation | +| `` | aruba.port | +| `` | aruba.port | +| `` | aruba.unit | #### [SFTP Client events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/SFTP_CLIENT.htm) | Field | Description | Type | Common | @@ -1582,6 +1593,26 @@ The `log` dataset collects the HPE Aruba CX logs. | aruba.qos.new_slot | | keyword | | aruba.qos.queue | | keyword | | aruba.redundant.mgmt_module | | keyword | +| aruba.rest.added_user | | keyword | +| aruba.rest.autztype | | keyword | +| aruba.rest.central_location | | keyword | +| aruba.rest.central_source | | keyword | +| aruba.rest.command | | keyword | +| aruba.rest.config_from_name | | keyword | +| aruba.rest.config_name | | keyword | +| aruba.rest.config_to_name | | keyword | +| aruba.rest.deleted_user | | keyword | +| aruba.rest.dns | | keyword | +| aruba.rest.dns_nameserver | | keyword | +| aruba.rest.identity | | keyword | +| aruba.rest.match | | keyword | +| aruba.rest.mode | | keyword | +| aruba.rest.name | | keyword | +| aruba.rest.operation | | keyword | +| aruba.rest.resource | | keyword | +| aruba.rest.subscriber | | keyword | +| aruba.rest.subscription | | keyword | +| aruba.rest.type | | keyword | | aruba.role | | keyword | | aruba.rpvst.new_mode | | keyword | | aruba.rpvst.npvid | | keyword | @@ -1592,11 +1623,20 @@ The `log` dataset collects the HPE Aruba CX logs. | aruba.rpvst.pkt_type | | keyword | | aruba.rpvst.proto | | keyword | | aruba.rpvst.pvid | | keyword | +| aruba.self_test.stack | | keyword | | aruba.sequence | | keyword | | aruba.server.mode | | keyword | | aruba.server.sessions | | long | | aruba.session.id | | keyword | | aruba.session.name | | keyword | +| aruba.sflow.bridge | | keyword | +| aruba.sflow.chain | | keyword | +| aruba.sflow.dgramsize | | long | +| aruba.sflow.intvl | | keyword | +| aruba.sflow.mode | | keyword | +| aruba.sflow.new_rate | | keyword | +| aruba.sflow.old_rate | | keyword | +| aruba.sflow.operation | | keyword | | aruba.slot | | long | | aruba.state | | keyword | | aruba.status | | keyword |