access logs from bluecoat proxy to windows user-id agent

[fwguy77]

Trying to get bluecoat proxy to send its access logs to windows user-id agent. configured custom log on bluecoat in the following format

PAN Source=$(c-ip) Username=$(cs-username) Action=$(s-action)

On user-id agent side I am seeing server receiving syslog messages in the format specified

PAN Source=x.x.x.x Username=usernamexxx Action=TCP_HIT

PAN Source=x.x.x.x Username=usernamexxx Action=TUNNELED

...

User-ID agent is confiured with parse filter using Field

Event String: PAN

Username Prefix: Username=

Username Delimeter: \s

Address Prefix: Source=

Address Delimeter: \s

In the UaDebug keep seeing this error

[Error  592]: Syslog msg len read error

Anyone run into the same issue?

What am I doing wrong?

[rmonvon]

{edit]

There is no comma after the IP address, and we specify the address delimiter has a comma.  Can you add another syslog field after the IP address to get the comma into the syslog message?

Other than that, I can't see anything wrong with your setup.  The syslog messages match against the fields & delimiters.  I would check the agent itself.  Restart the agent & maybe re-install agent.  Or just install another version of the agent on another server as a test.   Open a support case & have it diagnose is another option.

Thanks.

[fwguy77]

adding comma did not help.

I am getting the same failure still in vervose log on user-id agent

 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping T
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping U
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping N
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping N
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping E
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping L
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping E
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping D
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping ,
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping u
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping :
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping j
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping o
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping h
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping n
 07/05/16 04:16:27:439[Verbo  617]: Syslog msg, skipping s
 07/05/16 04:16:27:439[Error  592]: Syslog msg len read error
 07/05/16 04:16:27:439[Debug  355]: Event: type="XML API connection" name="<edited proxy IP>" status="Disconnected

I did create a support case, but it appears they are scratching their head too.

I think it may have something to with amount of data bluecoat is trying to send. It does not send syslog messages as individual messages, rather many of them at once.

[rmonvon]

Humm, that is odd.  Any chance you can try the onbox agent on the PA or spinning a new agent on another Win server?  Or try a different release 6.x or 7.x agent?

[netwerkbeheer_aswatson]

We have the same issue in the palo agent is there more information or a solution?