Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: update Bluecoat sourcetype to match TA 3.8.1 #2370

Merged
merged 1 commit into from May 13, 2024
Merged

fix: update Bluecoat sourcetype to match TA 3.8.1 #2370

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/sources/vendor/Broadcom/proxy.md
View file
Open in desktop
Expand Up @@ -23,14 +23,14 @@ Broadcom products are inclusive of products formerly marketed under Symantec and

| sourcetype | notes |
|----------------|---------------------------------------------------------------------------------------------------------|
| bluecoat:proxysg:access:kv | Requires version TA 3.6 |
| bluecoat:proxysg:syslog | Requires version TA 3.6 |
| bluecoat:proxysg:access:kv | Requires version TA 3.8.1 |
| bluecoat:proxysg:access:syslog | Requires version TA 3.8.1 |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Am I understood correctly that add-on maintainers broke backward compatibility (changed sourcetype) starting with 3.8.1 version ? Or it was our bug?

Can we talk with them to understand the reason? Probably they will rollback this change if add-on not very popular :)

If we need to provide new sourcetype, probably good idea will be use some env var like BLUECOAT_NEW_FORMAT=false and will determine that we need assign old or new sourcetype for bluecoat. If will help us to prevent of breaking backward compatibility

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's a good question, 3.8.1 was released in September 2022 and I don't have access to older versions to check if that was changed on the TA side or there was a bug in SC4S

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

especially that bluecoat:proxysg:access:syslog is more consistent with the rest than bluecoat:proxysg:syslog

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mstopa-splunk you are right, it's impossible to check, because they deleted previous versions :)

Only 3.8.1 available on Splunkbase :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ikheifets-splunk please see how this has been done previously:

https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/Dell/sonicwall/

Note:[¶](https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/Dell/sonicwall/#note)
The sourcetype has been changed in version 2.35.0 making it compliant with corresponding TA.

the practice seems to be updating the sourcetype and adding the note


## Sourcetype and Index Configuration

| key | sourcetype | index | notes |
|----------------|----------------|----------------|----------------|
| bluecoat_proxy | bluecoat:proxysg:syslog | netops | none |
| bluecoat_proxy | bluecoat:proxysg:access:syslog | netops | none |
| bluecoat_proxy_splunkkv | bluecoat:proxysg:access:kv | netproxy | none |


Expand Down
2 changes: 1 addition & 1 deletion package/etc/conf.d/conflib/syslog/app-syslog-symantec_proxysg.conf
View file
Open in desktop
Expand Up @@ -4,7 +4,7 @@ block parser app-syslog-symantec_proxysg() {
rewrite {
r_set_splunk_dest_default(
index("netops")
sourcetype('bluecoat:proxysg:syslog')
sourcetype('bluecoat:proxysg:access:syslog')
vendor('bluecoat')
product('proxy')
class('syslog')
Expand Down
2 changes: 1 addition & 1 deletion package/lite/etc/addons/broadcom/app-syslog-symantec_proxysg.conf
View file
Open in desktop
Expand Up @@ -4,7 +4,7 @@ block parser app-syslog-symantec_proxysg() {
rewrite {
r_set_splunk_dest_default(
index("netops")
sourcetype('bluecoat:proxysg:syslog')
sourcetype('bluecoat:proxysg:access:syslog')
vendor('bluecoat')
product('proxy')
class('syslog')
Expand Down
2 changes: 1 addition & 1 deletion tests/test_symantec_proxy.py
View file
Open in desktop
Expand Up @@ -105,7 +105,7 @@ def test_bluecoatproxySG_syslog(
sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])

st = env.from_string(
'search _time={{ epoch }} index=netops host="{{ host }}" sourcetype="bluecoat:proxysg:syslog"'
'search _time={{ epoch }} index=netops host="{{ host }}" sourcetype="bluecoat:proxysg:access:syslog"'
)
search = st.render(epoch=epoch, host=host)

Expand Down