Hi Geoff,
Have you enabled syslog listener on the management profile?
Once you have that committed, you are sure to receive SYSLOG packets in tcpdump. Maybe check/remove any filter you got while taking a tcpdump.
Run the following commands and check logs.
admin@anuragFW> debug user-id on debug
admin@anuragFW> debug user-id set userid syslog
admin@anuragFW> tail follow yes mp-log useridd.log
Then, to verify your regex/filter expression use the following commands:
admin@anuragFW> test user-id user-id-syslog-parse regex-identifier event-regex <value> username-regex <value> address-regex <value> log-string <value>
admin@anuragFW> test user-id user-id-syslog-parse field-identifier event-string <value> username-prefix <value> username-delimiter <value> address-prefix <value> address-delimiter <value> log-string <value
If you are having trouble figuring out which regex is not being read correctly, feed the log-string values different sections of syslog messages. That's just something you gotta play around and figure out. Some special characters need to be escaped while some will not be allowed.
You can post a sample of syslog messages and we could possibly look into it.
Hope this helps.
Regards,
Anurag
