Create Sonicwall log parser plugin

[ericwholt]

This parser will parse Sonicwall logs. This plugin uses key_value parser which requires stanza 1.2.7. Used https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf as reference for fields. It handles two log types. One that starts with a syslog priority format <134> and another that starts with Apr 1 10:45:16 10.1.5.1 these were the only example logs I had available at the time of creating this plugin.

Example Output

{
  "timestamp": "2004-04-01T10:39:35-05:00",
  "severity": 40,
  "severity_text": "5",
  "labels": {
    "file_name": "logs.log",
    "file_name_resolved": "logs.log",
    "file_path": "/Users/ericholt/bindplane/bplogagent-dev/sonicwall-logs/logs.log",
    "file_path_resolved": "/Users/ericholt/bindplane/bplogagent-dev/sonicwall-logs/logs.log",
    "log_type": "sonicwall",
    "plugin_id": "sonicwall"
  },
  "record": {
    "c": "64",
    "dst": "67.32.44.2:445:LAN",
    "fw": "67.32.44.2",
    "host": "10.1.5.1",
    "id": "firewall",
    "m": "36",
    "msg": "TCP connection dropped",
    "n": "2686",
    "pri": "5",
    "proto": "tcp",
    "sn": "00301E0526B1",
    "src": "67.101.200.27:4507:WAN"
  }
}

[jsirianni]

Couple additional things:

1. File input likely is not approbate. I know we were not sure what the transport medium would be, so this is fine for now but I suspect we will switch to udp / tcp before merging.
2. Tests are failing, update go.mod to use stanza 1.2.7, which will give you the k/v parser.

edit: lets use UDP

[jsirianni]

Lets rename msg to message

[jsirianni]

Please make the following changes

• file_input --> UDP
• provide sample logs

Otherwise I think it looks good

[jsirianni]

Not sure what is happening,

you can send over udp like this:

echo '<134>  id=LVM_Sonicwall sn=18B1693B2C90 time="2021-09-13 18:16:13" fw=142.166.177.10 pri=6 c=262144 gcat=6 m=98 msg="Connection Opened" src=192.168.11.53:36510:X0 natSrc=142.166.177.10:51879 dst=142.250.64.68:443:X1 natDst=142.250.64.68:443 proto=tcp/https sent=60 n=53798' | nc -u localhost 5140

config

pipeline:
- type: sonicwall
  listen_port: 5140
  location: UTC
- type: stdout

If I use just udp, it works fine and has output. With the sonicwall plugin I do not get output.

[jsirianni]

{
  "timestamp": "2021-09-13T18:16:13Z",
  "severity": 30,
  "severity_text": "134",
  "labels": {
    "log_type": "sonicwall",
    "net.host.ip": "::",
    "net.host.port": "5555",
    "net.peer.ip": "::1",
    "net.peer.port": "33248",
    "net.transport": "IP.UDP",
    "plugin_id": "sonicwall"
  },
  "record": {
    "c": "262144",
    "dst": "142.250.64.68:443:X1",
    "fw": "142.166.177.10",
    "gcat": "6",
    "id": "LVM_Sonicwall",
    "m": "98",
    "message": "Connection Opened",
    "n": "53798",
    "natDst": "142.250.64.68:443",
    "natSrc": "142.166.177.10:51879",
    "pri": "6",
    "priority": "134",
    "proto": "tcp/https",
    "sent": "60",
    "sn": "18B1693B2C90",
    "src": "192.168.11.53:36510:X0"
  }
}