Below is an example of a trap we receive from our Cisco PIX firewalls. It is
actually a syslog message, generated by the firewall, that is received by
NetView and converted to a trap via the Cisco syslog mib that I've loaded into
NetView. There are several different syslog messages that can come into
NetView, from the firewalls, but they are all converted and displayed as events
via the same syslog mib.
What I would like to do is capture the trap and display a different customized
event, based on the clogHistMsgText=?????? field (which will be different
depending on the syslog message sent from the firewall). I believe that field
is $4. Is this possible? Can it be done via a ruleset or some other method?
Wed Jun 02 11:04:06 1999 192.168.34.1 A clogMessageGenerated trap
received from enterprise ciscoSylogMIBNotificationPrefix with 5 arguments:
clogHistFacility=20; clogHistSeverity=7; clogHistMsgName=Syslog Trap;
clogHistMsgText=302009; 0 in use, 16384 licensed, 3 most used;
clogHistTimestamp=0
SPECIFIC : 1 (hex: 1)
GENERIC : 6
CATEGORY : Status Events
ENTERPRISE : ciscoSyslogMIBNotificationPrefix 1.3.6.1.4.1.9.9.41.2
|