Decoder Problem with extra colons

[Frederico Detofano]

Dear folks,

I am creating a custom decoder for syslog messages generated by an OLT, and i'm having issues with a log with extra colons;

• Wazuh Manager: 4.14.x
• Decoder type: PCRE2
• Testing using wazuh-logtest

When the log contains the following format:

Jul 16 14:15:45 OLT_01-PF : 1/1 : <Info> %AAA-USER_SESSION_STOP : aaa-app[4562] : User [admin]: Closed session ID 684388

the event reaches Phase 1 correctly, but no decoder matches, even though the decoder only contains a simple prematch.

Phase 1:

**Phase 1: Completed pre-decoding.
    full event: 'Jul 16 14:15:45 OLT_01-PF : 1/1 : <Info> %AAA-USER_SESSION_STOP : aaa-app[4562] : User [admin]: Closed session ID 684388'
    timestamp: 'Jul 16 14:15:45'
    hostname: 'OLT_01-PF'
    program_name: ''

Phase 2:

**Phase 2: Completed decoding.
    No decoder matched.

Example Decoder:

<decoder name="olt-gpon">
    <prematch type="pcre2">AAA-USER_SESSION_STOP</prematch>
</decoder>

<decoder name="olt-gpon-child">
    <parent>olt-gpon</parent>
    <regex type="pcre2">Info</regex>
    <order>event.severity</order>
</decoder>

<decoder name="olt-gpon-child">
    <parent>olt-gpon</parent>
    <regex type="pcre2">User\s+\[([^\]]+)\]</regex>
    <order>user</order>
</decoder>

The prematch is intentionally minimal, so I would expect the parent decoder to match regardless of the remaining message structure.

Testing:

If I remove only the colon immediately after the hostname, changing the message to:

Jul 16 14:15:45 OLT_01-PF 1/1 : <Info> %AAA-USER_SESSION_STOP : aaa-app[4562] : User [admin]: Closed session ID 684388

The decoder works perfectly.

Phase 1:

**Phase 1: Completed pre-decoding.
    full event: 'Jul 16 14:15:45 OLT_01-PF 1/1 : <Info> %AAA-USER_SESSION_STOP : aaa-app[4562] : User [admin]: Closed session ID 684388'
    timestamp: 'Jul 16 14:15:45'
    hostname: 'OLT_01-PF'

Phase 2:

**Phase 2: Completed decoding.
    name: 'olt-gpon'
    dstuser: 'admin'

The only difference between both logs is the extra colon after the hostname.

Is normalizing this log with an external syslog the only way to parse?

Many thanks!

[Olamilekan Abdullateef Ajani]

Hello Frederico,

The issue is with the extra colon from the log source, Wazuh treats that colon as the separator normally used after a program name. Since there is nothing between the hostname and the colon, Phase 1 produces that space.

When a program_name is detected, even as an empty value, a decoder containing only <prematch> may not be evaluated as expected because it still requires the reference for prorgam_name.

Ref:
https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/log-data-analysis.html

That said, for your custom decoder to work, you need to declare the program name as is:  <program_name type="pcre2">^$</program_name>

Which means your decoder will now look like:

<decoder name="olt-gpon"> 

<program_name type="pcre2">^$</program_name> 

<prematch type="pcre2">AAA-USER_SESSION_STOP</prematch> 

</decoder>

Please let me know if you require further clarification on this.

Ref:
https://wazuh.com/blog/creating-decoders-and-rules-from-scratch/
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/decoders.html