parse JunOS SRX logs without a source NAT rule name

It appears that some logs may not have a source NAT rule name defined. When this is the case, 'source rule RULE' is replaced by 'N/A N/A'.
napalm-automation · Dec 3, 2018 · 5770ccd · 5770ccd
1 parent 5883f19
commit 5770ccd
Show file tree

Hide file tree

Showing 4 changed files with 48 additions and 4 deletions.
diff --git a/napalm_logs/config/junos/NAT_SESSION_CLOSED.yml b/napalm_logs/config/junos/NAT_SESSION_CLOSED.yml
@@ -16,10 +16,10 @@ messages:
       natSourcePort: (\d+)
       natDestinationAddress: ((?:[0-9]{1,3}\.){3}[0-9]{1,3})
       natDestinationPort: (\d+)
-      srcNatRuleName: ([^ ]+)
+      srcNatRuleName: (?:source rule ([^ ]+)|N\/A N\/A)
       protocolId: (\d+)
       miscData: (.*)
-    line: 'session closed {reason}: {sourceAddress}/{sourcePort}->{destinationAddress}/{destinationPort} {serviceName} {natSourceAddress}/{natSourcePort}->{natDestinationAddress}/{natDestinationPort} source rule {srcNatRuleName} N/A N/A {protocolId} {miscData}'
+    line: 'session closed {reason}: {sourceAddress}/{sourcePort}->{destinationAddress}/{destinationPort} {serviceName} {natSourceAddress}/{natSourcePort}->{natDestinationAddress}/{natDestinationPort} {srcNatRuleName} N/A N/A {protocolId} {miscData}'
     model: NO_MODEL
     mapping:
       variables:

diff --git a/napalm_logs/config/junos/NAT_SESSION_CREATED.yml b/napalm_logs/config/junos/NAT_SESSION_CREATED.yml
@@ -15,10 +15,10 @@ messages:
       natSourcePort: (\d+)
       natDestinationAddress: ((?:[0-9]{1,3}\.){3}[0-9]{1,3})
       natDestinationPort: (\d+)
-      srcNatRuleName: ([^ ]+)
+      srcNatRuleName: (?:source rule ([^ ]+)|N\/A N\/A)
       protocolId: (\d+)
       miscData: (.*)
-    line: 'session created {sourceAddress}/{sourcePort}->{destinationAddress}/{destinationPort} {serviceName} {natSourceAddress}/{natSourcePort}->{natDestinationAddress}/{natDestinationPort} source rule {srcNatRuleName} N/A N/A {protocolId} {miscData}'
+    line: 'session created {sourceAddress}/{sourcePort}->{destinationAddress}/{destinationPort} {serviceName} {natSourceAddress}/{natSourcePort}->{natDestinationAddress}/{natDestinationPort} {srcNatRuleName} N/A N/A {protocolId} {miscData}'
     model: NO_MODEL
     mapping:
       variables:

diff --git a/tests/config/junos/NAT_SESSION_CREATED/icmp/syslog.msg b/tests/config/junos/NAT_SESSION_CREATED/icmp/syslog.msg
@@ -0,0 +1 @@
+<14>Dec 13 13:12:00 srx-firewall RT_FLOW: RT_FLOW_SESSION_CREATE: session created 172.16.0.1/27->8.8.8.8/28713 icmp 172.16.0.2/27->8.8.8.8/28713 N/A N/A N/A N/A 1 allow-any-from-probe SZ-PUBLIC SZ-PUBLIC 20805406 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN
diff --git a/tests/config/junos/NAT_SESSION_CREATED/icmp/yang.json b/tests/config/junos/NAT_SESSION_CREATED/icmp/yang.json
@@ -0,0 +1,43 @@
+{
+    "yang_message": {
+        "security": {
+            "flow": {
+                "created": {
+                    "source_address": "172.16.0.1",
+                    "source_port": "27",
+                    "destination_address": "8.8.8.8",
+                    "destination_port": "28713",
+                    "service_name": "icmp",
+                    "nat_source_address": "172.16.0.2",
+                    "nat_source_port": "27",
+                    "nat_destination_address": "8.8.8.8",
+                    "nat_destination_port": "28713",
+                    "src_nat_rule_name": null,
+                    "protocol_id": "1",
+                    "misc_data": "allow-any-from-probe SZ-PUBLIC SZ-PUBLIC 20805406 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN"
+                }
+            }
+        }
+    },
+    "message_details": {
+        "processId": null,
+        "severity": 6,
+        "facility": 1,
+        "hostPrefix": null,
+        "pri": "14",
+        "processName": "RT_FLOW",
+        "host": "srx-firewall",
+        "tag": "RT_FLOW_SESSION_CREATE",
+        "time": "13:12:00",
+        "date": "Dec 13",
+        "message": "session created 172.16.0.1/27->8.8.8.8/28713 icmp 172.16.0.2/27->8.8.8.8/28713 N/A N/A N/A N/A 1 allow-any-from-probe SZ-PUBLIC SZ-PUBLIC 20805406 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN"
+    },
+    "timestamp": 1500587040,
+    "facility": 1,
+    "ip": "127.0.0.1",
+    "host": "srx-firewall",
+    "yang_model": "NO_MODEL",
+    "error": "NAT_SESSION_CREATED",
+    "os": "junos",
+    "severity": 6
+}