Hi,

Recently I tried some ASL scripting to parse a syslog feed from kiwi into Smarts Notification List.

Problem is I am not skilled to ASL program it correctly and did a bad implementation of reading the severity of an syslog event.

When you get a cisco syslog event it is pretty easy to understand how the message is constructed. The downsight is I don't know

how to extract the severity of the message correctly. Current approach is reading the MESSAGE and extract the 27th char which is most

cases for Cisco has the level of severity. So here $level gets the "6". Problem is I haven't found a way that works the same but extracts the "6" from the message based on -6- what is between the "-" char.

*May  1 22:12:13.243: %SEC-6-IPACCESSLOGP:

My current my-hook-syslog.asl code snippet:

PARSE_MESSAGE {
} do {
    // By default use a slice of 100 characters as part of EVENTNAME
    slice = substring(MESSAGE, 0, 100);

    level = substring(MESSAGE, 27, 1)

}

CUSTOM_RULE {
    unusedPrefix:rep(notany(":")) ":"           /* consume chars up to : */
    msgDescription:rep(word) eol
} do {
       if (level == "1") {
               SEVERITY = "1"
       } else if (level == "2") {
             SEVERITY = "1"
       } else if (level == "3") {
             SEVERITY = "2"
       } else if (level == "4") {
             SEVERITY = "3"
       } else if (level == "5") {
             SEVERITY = "3"
       } else if (level == "6") {
             SEVERITY = "5"
       } else if (level == "7") {
             SEVERITY = "5"
       }
     if (debug) { print(time().ASLNAME."Executing CUSTOM_RULE");}
}

So my question is easy, how can I extract the severity where the level is on a different position:

%IPV6-6-ACCESSLOGP or %LINK-3-UPDOWN.

Thanks,

Jeroen Tebbens

Dimension Data Netherlands