cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1884
Views
5
Helpful
2
Replies
scamarda
Cisco Employee

Regex for Syslog Username Parsing

I am trying to get identity from some of my users logging into a Centos 6.  I am able to get the IP address of the machine but am having trouble parsing the username.  I am not able to get the quotes stripped from the username.  The regex string with ISE 2.3P1 doesn't seem to follow the regex that I am used to.  How can I strip the "" from the username, or does it matter that it is surrounded by quotes?

I tried using acct=[^, ]* but that results in my issue of getting "jsmith".

type=CRED_DISP msg=audit(1513039700.390:8262): user pid=19739 uid=0 auid=500 ses=1225 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="jsmith" exe="/usr/sbin/sshd" hostname=metlab2008-svr1.metlab.local addr=10.1.1.92 terminal=ssh res=success'

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Timothy Abbott
Cisco Employee

Sam,

The below should get you what you need:

acct="([a-zA-Z0-9\_]+)"

Regards,

-Tim

View solution in original post

2 REPLIES 2
Timothy Abbott
Cisco Employee

Sam,

The below should get you what you need:

acct="([a-zA-Z0-9\_]+)"

Regards,

-Tim

View solution in original post

That worked.  Thanks.

Content for Community-Ad