Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IDSM and external database

Is anyone out there populating an external database with IDSM logs? I would like to somehow populate a PostgreSQL database in as close to real-time as possible. Anyone doing anything like this? Is it even possible? Any information would be greatly appreciated.

Jason Fletcher

6 REPLIES
Cisco Employee

Re: IDSM and external database

The Unix Director config note provides a little bit of information on this:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids7/unix_cfg/rdbms.htm#xtocid1886819

New Member

Re: IDSM and external database

Sorry, I should have specified that I am using CSPM. Any ideas with that?

Cisco Employee

Re: IDSM and external database

Within CSPM there is a program cvtnrlog which will pull the information from the CSPM database and create a comma delimited file.

You can thern write scripts to load this comma delimited file into your database.

The previous link and the following can be used as reference when setting up your database.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids7/unix_cfg/dmp.htm#13776

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids7/unix_cfg/schemas.htm

New Member

Re: IDSM and external database

OK, this isn't an extremely fluid option...but I also want to be able to log shun commands into my database. Any ideas?

Jason

New Member

Re: IDSM and external database

When I use cvtnrlog I don't get the same information as when I view the context buffer within the Event Viewer. I get bunch of characters where I think the context buffer info should be.

Is there a special switch you use to get exactly what is in the context buffer?

Thank you,

Chris

Cisco Employee

Re: IDSM and external database

The characters you are seeing are the hexadecimal values for the characters in the Context Buffer.

The Context Buffer contains returns, backspaces, and other characters which would cause problems in a comma delimited file. So each character is converted to it's hexadecimal equivelant. It is up to the user then to convert the hexadecimal values back to their ascii equivelants when they want to view the Context Buffer.

(CSPM and Unix Director do this automatically when you view the Context Buffer, but won't write it out like that to a comma delimited file)

How to convert:

Take 2 characters at a time and look up the corresponding value in Hexadecimal to Ascii Character table.

There is also a special "ZZ" character that you will not find in the table. This "ZZ" is just a seperator. There are actually 2 Context Buffers in that field. One for characters from the Source, and one for characters from the Destination. The "ZZ" separates these 2 Context Buffers.

You can find the Hexadecimal to Ascii Character table by executing "man ascii" on a Unix box or searching the web.

I've attached the table from the "man ascii" command I executed on one of my boxes:

Hexadecimal - Character

| 00 NUL| 01 SOH| 02 STX| 03 ETX| 04 EOT| 05 ENQ| 06 ACK| 07 BEL|

| 08 BS | 09 HT | 0A NL | 0B VT | 0C NP | 0D CR | 0E SO | 0F SI |

| 10 DLE| 11 DC1| 12 DC2| 13 DC3| 14 DC4| 15 NAK| 16 SYN| 17 ETB|

| 18 CAN| 19 EM | 1A SUB| 1B ESC| 1C FS | 1D GS | 1E RS | 1F US |

| 20 SP | 21 ! | 22 " | 23 # | 24 $ | 25 % | 26 & | 27 ' |

| 28 ( | 29 ) | 2A * | 2B + | 2C , | 2D - | 2E . | 2F / |

| 30 0 | 31 1 | 32 2 | 33 3 | 34 4 | 35 5 | 36 6 | 37 7 |

| 38 8 | 39 9 | 3A : | 3B ; | 3C < | 3D = | 3E > | 3F ? |

| 40 @ | 41 A | 42 B | 43 C | 44 D | 45 E | 46 F | 47 G |

| 48 H | 49 I | 4A J | 4B K | 4C L | 4D M | 4E N | 4F O |

| 50 P | 51 Q | 52 R | 53 S | 54 T | 55 U | 56 V | 57 W |

| 58 X | 59 Y | 5A Z | 5B [ | 5C \ | 5D ] | 5E ^ | 5F _ |

| 60 ` | 61 a | 62 b | 63 c | 64 d | 65 e | 66 f | 67 g |

| 68 h | 69 i | 6A j | 6B k | 6C l | 6D m | 6E n | 6F o |

| 70 p | 71 q | 72 r | 73 s | 74 t | 75 u | 76 v | 77 w |

| 78 x | 79 y | 7A z | 7B { | 7C | | 7D } | 7E ~ | 7F DEL|

221
Views
0
Helpful
6
Replies
CreatePlease to create content