Skip to content

Commit b375da9

Browse files
ajasnoszajasnosz
authored
fix: update citrix netscaler date parser (#2735)
1 parent 8e9240c commit b375da9

File tree

5 files changed

+79
-24
lines changed

5 files changed

+79
-24
lines changed

‎docs/sources/vendor/Citrix/netscaler.md‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,27 +7,33 @@
77

88
## Links
99

10-
| Ref | Link |
11-
|----------------|---------------------------------------------------------------------------------------------------------|
12-
| Splunk Add-on | <https://splunkbase.splunk.com/app/2770/> |
10+
| Ref | Link |
11+
|----------------|-----------------------------------------------------------------------------------------------------|
12+
| Splunk Add-on | <https://splunkbase.splunk.com/app/2770/> |
1313
| Product Manual | <https://docs.citrix.com/en-us/citrix-adc/12-1/system/audit-logging/configuring-audit-logging.html> |
1414

1515
## Sourcetypes
1616

17-
| sourcetype | notes |
18-
|----------------|---------------------------------------------------------------------------------------------------------|
19-
| citrix:netscaler:syslog | None |
20-
| citrix:netscaler:appfw | None |
21-
| citrix:netscaler:appfw:cef | None |
17+
| sourcetype | notes |
18+
|----------------------------|-------|
19+
| citrix:netscaler:syslog | None |
20+
| citrix:netscaler:appfw | None |
21+
| citrix:netscaler:appfw:cef | None |
2222

2323
## Sourcetype and Index Configuration
2424

25-
| key | sourcetype | index | notes |
26-
|----------------|----------------|----------------|----------------|
27-
| citrix_netscaler | citrix:netscaler:syslog | netfw | none |
28-
| citrix_netscaler | citrix:netscaler:appfw | netfw | none |
29-
| citrix_netscaler | citrix:netscaler:appfw:cef | netfw | none |
25+
| key | sourcetype | index | notes |
26+
|------------------|----------------------------|-------|-------|
27+
| citrix_netscaler | citrix:netscaler:syslog | netfw | none |
28+
| citrix_netscaler | citrix:netscaler:appfw | netfw | none |
29+
| citrix_netscaler | citrix:netscaler:appfw:cef | netfw | none |
3030

3131
## Source Setup and Configuration
3232

33-
* Follow vendor configuration steps per Product Manual above. Ensure the data format selected is "DDMMYYYY"
33+
* Follow vendor configuration steps per Product Manual above.
34+
35+
## Options
36+
37+
| Variable | default | description |
38+
|--------------------------------------------|--------------|-----------------------------------------------------------------------------------------------|
39+
| `SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER` | empty string | (empty/yes) Set to "yes" for parsing the date in format `dd/mm/yyyy` instead of `mm/dd/yyyy`. |

‎package/enterprise/etc/conf.d/conflib/almost-syslog/app-almost-syslog-citrix_netscaler.conf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
1010
parser {
1111
regexp-parser(
1212
prefix(".tmp.")
13-
patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
13+
patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
1414
);
1515
};
1616
parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
1919
);
2020
};
2121

22+
2223
if {
23-
filter { "${.tmp.tspart1}" eq "$R_DAY"};
24+
filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
2425
parser {
2526
date-parser-nofilter(
26-
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
27+
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
2728
template("${.tmp.timestamp}")
2829
);
2930
};

‎package/etc/conf.d/conflib/almost-syslog/app-almost-syslog-citrix_netscaler.conf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
1010
parser {
1111
regexp-parser(
1212
prefix(".tmp.")
13-
patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
13+
patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
1414
);
1515
};
1616
parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
1919
);
2020
};
2121

22+
2223
if {
23-
filter { "${.tmp.tspart1}" eq "$R_DAY"};
24+
filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
2425
parser {
2526
date-parser-nofilter(
26-
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
27+
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
2728
template("${.tmp.timestamp}")
2829
);
2930
};

‎package/lite/etc/addons/citrix/app-almost-syslog-citrix_netscaler.conf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
1010
parser {
1111
regexp-parser(
1212
prefix(".tmp.")
13-
patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
13+
patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
1414
);
1515
};
1616
parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
1919
);
2020
};
2121

22+
2223
if {
23-
filter { "${.tmp.tspart1}" eq "$R_DAY"};
24+
filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
2425
parser {
2526
date-parser-nofilter(
26-
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
27+
format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
2728
template("${.tmp.timestamp}")
2829
);
2930
};

‎tests/test_citrix_netscaler.py‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44
# license that can be found in the LICENSE-BSD2 file or at
55
# https://opensource.org/licenses/BSD-2-Clause
66
import datetime
7+
import os
8+
from unittest.mock import patch
9+
710
import shortuuid
811
import pytz
912
import pytest
@@ -28,7 +31,7 @@ def test_citrix_netscaler(record_property, setup_splunk, setup_sc4s, get_pid):
2831
_, bsd, time, _, _, tzname, epoch = time_operations(dt)
2932

3033
# Tune time functions
31-
time = dt.strftime("%d/%m/%Y:%H:%M:%S")
34+
time = dt.strftime("%m/%d/%Y:%H:%M:%S")
3235
epoch = epoch[:-7]
3336

3437
mt = env.from_string(
@@ -91,6 +94,49 @@ def test_citrix_netscaler_sdx(
9194

9295
assert result_count == 1
9396

97+
# <134> 05/08/2025:03:13:15 GMT DC-NS02 0-PPE-0 : default TCP CONN_TERMINATE 1874124822 0 : Source 10.x.x.x:47990 - Destination 10.x.x.x:80 - Start Time 26/03/2025:21:13:15 GMT - End Time 26/03/2025:21:13:15 GMT - Total_bytes_send 1 - Total_bytes_recv 1
98+
@pytest.mark.addons("citrix")
99+
@patch.dict(
100+
os.environ,
101+
{
102+
"SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER": "yes",
103+
},
104+
clear=False
105+
)
106+
def test_citrix_netscaler_new_date_format(
107+
record_property, setup_splunk, setup_sc4s, get_pid
108+
):
109+
host = f"test-ctitrixns-host-{shortuuid.ShortUUID().random(length=5).lower()}-{shortuuid.ShortUUID().random(length=5).lower()}"
110+
pid = get_pid
111+
112+
dt = datetime.datetime.now(datetime.timezone.utc)
113+
_, bsd, time, _, _, tzname, epoch = time_operations(dt)
114+
115+
# Tune time functions
116+
time = dt.strftime("%d/%m/%Y:%H:%M:%S")
117+
epoch = epoch[:-7]
118+
119+
mt = env.from_string(
120+
"{{ mark }} {{ time }} GMT {{ host }} 0-PPE-0 : default TCP CONN_TERMINATE 1874124822 0 : Source 10.x.x.x:47990 - Destination 10.x.x.x:80 - Start Time 26/03/2025:21:13:15 GMT - End Time 26/03/2025:21:13:15 GMT - Total_bytes_send 1 - Total_bytes_recv 1\n"
121+
)
122+
message = mt.render(
123+
mark="<134>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid
124+
)
125+
126+
sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
127+
128+
st = env.from_string(
129+
'search _time={{ epoch }} index=netfw host={{ host }} sourcetype="citrix:netscaler:syslog"'
130+
)
131+
search = st.render(epoch=epoch, host=host, pid=pid)
132+
133+
result_count, _ = splunk_single(setup_splunk, search)
134+
135+
record_property("host", host)
136+
record_property("resultCount", result_count)
137+
record_property("message", message)
138+
139+
assert result_count == 1
94140

95141
# [289]: AAA Message : In receive_ldap_user_search_event: ldap_first_entry returned null, user ssgconfig not found
96142
@pytest.mark.addons("citrix")

0 commit comments

Comments
 (0)