I am currently parsing a very big environment with a large amount of network devices. My job... to parse the data as a whole to display audit events like Logins, Log off, object creations, access, and so on. At the moment I have these types of devices.
1. ASR1002
2.F5 Big IP 5050
3. Catalyst devices
4.ASA devices
5. and so on....
Syslog is already being sent to a syslog server which Splunk collects in its indexers. I can create the Splunk SPL to parse the message with regular expressions but my concern is that each different Cisco device type/model sends log messages in different formats for example.
ASA ----> "ASA-6-611101" vs. "%SEC_LOGIN-5-LOGIN_SUCCESS"
I want to make sure I capture all necessary events or log types per cisco device/type; if this is even a thing.... ?!
is there a place I can find syslog type format per device?
maybe a location I can find a list of ASA log messages?
is ASA type only for ASA devices or all firewall devices?
forgive my ignorance usually don't deal with syslog messages often.
