This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About fwguy77
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About fwguy77
06-30-2020
4Posts
0Likes
0Solutions
Jun 30, 2020Last Visited
User
Activity
User
Profile
Latest posts by fwguy77
| Subject | Views | Posted |
|---|---|---|
| 4523 | 07-05-2016 01:24 AM | |
| 4779 | 06-28-2016 10:44 PM | |
| 4787 | 06-28-2016 05:50 PM | |
| 4896 | 06-25-2016 10:02 PM |
User Badges
Community Statistics
| Member Since | 06-25-2016 09:54 PM |
| Date Last Visited | 06-30-2020 03:17 PM |
| Posts | 4 |
07-05-2016
01:24 AM
adding comma did not help. I am getting the same failure still in vervose log on user-id agent 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping T 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping U 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping N 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping N 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping E 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping L 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping E 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping D 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping , 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping u 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping : 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping j 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping o 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping h 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping n 07/05/16 04:16:27:439[Verbo 617]: Syslog msg, skipping s 07/05/16 04:16:27:439[Error 592]: Syslog msg len read error 07/05/16 04:16:27:439[Debug 355]: Event: type="XML API connection" name="<edited proxy IP>" status="Disconnected I did create a support case, but it appears they are scratching their head too. I think it may have something to with amount of data bluecoat is trying to send. It does not send syslog messages as individual messages, rather many of them at once.
... View more
06-28-2016
10:44 PM
I don't have kiwi, but I have wireshark running on windows box where user-id agent is installed and I am seeing in wireshark something like below TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_POLICY_REDIRECT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_CLIENT_REFRESH,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_HIT,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TUNNELED,u:johns,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_DENIED,u:-,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_ACCELERATED,u:johns,s:10.1.1.100 TCP_NC_MISS,u:johns,s:10.1.1.100
... View more
06-28-2016
05:50 PM
Thank you rmonvon. No result 😞 I see in verbose output that it is processing syslog, but then it shows error at the end. For example first message in a syslog would be PFW Source=some ip,Username=johns,Action=TCP_HIT 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping P 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping F 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping W 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping S 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping o 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping u 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping r 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping c 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping e 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping = 06/28/16 20:44:58:388[Verbo 596]: Syslog msg len is 10 06/28/16 20:44:58:388[Debug 371]: Syslog: Unable to display contents of message, it exceeds the length debug messages allow. 06/28/16 20:44:58:388[Verbo 615]: recv 0-2047, msg 23-22 06/28/16 20:44:58:388[Verbo 596]: Syslog msg len is 4 06/28/16 20:44:58:388[Debug 371]: Syslog: Unable to display contents of message, it exceeds the length debug messages allow. 06/28/16 20:44:58:388[Verbo 615]: recv 0-2047, msg 28-27 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping r 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping n 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping a 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping m 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping e 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping = 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping j 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping o 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping h 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping n 06/28/16 20:44:58:388[Verbo 617]: Syslog msg, skipping s 06/28/16 20:44:58:388[Error 592]: Syslog msg len read error I will try to make a single message shorter
... View more
06-25-2016
10:02 PM
Trying to get bluecoat proxy to send its access logs to windows user-id agent. configured custom log on bluecoat in the following format PAN Source=$(c-ip) Username=$(cs-username) Action=$(s-action) On user-id agent side I am seeing server receiving syslog messages in the format specified PAN Source=x.x.x.x Username=usernamexxx Action=TCP_HIT PAN Source=x.x.x.x Username=usernamexxx Action=TUNNELED ... User-ID agent is confiured with parse filter using Field Event String: PAN Username Prefix: Username= Username Delimeter: \s Address Prefix: Source= Address Delimeter: \s In the UaDebug keep seeing this error [Error 592]: Syslog msg len read error Anyone run into the same issue? What am I doing wrong?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-30-2020
03:17 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks