forked from SEKOIA-IO/intake-formats
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request SEKOIA-IO#1140 from SEKOIA-IO/fix/vcenter_format
vCenter - parse more events
- Loading branch information
Showing
5 changed files
with
147 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
39 changes: 39 additions & 0 deletions
39
VMWare/vmware-vcenter/tests/other_tests_example1_type_7.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| { | ||
| "input": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T23:41:05.366919Z] [vim.event.ScheduledTaskCompletedEvent] [info] [com.vmware.vcIntegrity] [] [22222222] [Task VMware vSphere Update Manager Check Notification on Datacenters in datacenter completed successfully]" | ||
| }, | ||
| "expected": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T23:41:05.366919Z] [vim.event.ScheduledTaskCompletedEvent] [info] [com.vmware.vcIntegrity] [] [22222222] [Task VMware vSphere Update Manager Check Notification on Datacenters in datacenter completed successfully]", | ||
| "event": { | ||
| "category": [ | ||
| "network" | ||
| ], | ||
| "code": "vim.event.ScheduledTaskCompletedEvent", | ||
| "reason": "Task VMware vSphere Update Manager Check Notification on Datacenters in datacenter completed successfully", | ||
| "type": [ | ||
| "connection" | ||
| ] | ||
| }, | ||
| "@timestamp": "2024-06-18T23:41:05.366919Z", | ||
| "log": { | ||
| "level": "info" | ||
| }, | ||
| "observer": { | ||
| "product": "VCenter", | ||
| "vendor": "VMWare" | ||
| }, | ||
| "related": { | ||
| "user": [ | ||
| "com.vmware.vcIntegrity" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "user": { | ||
| "name": "com.vmware.vcIntegrity" | ||
| } | ||
| }, | ||
| "vmware_vcenter": { | ||
| "event_id": "11111111" | ||
| } | ||
| } | ||
| } |
42 changes: 42 additions & 0 deletions
42
VMWare/vmware-vcenter/tests/other_tests_example2_type_7.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| { | ||
| "input": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T23:28:06.155764Z] [vim.event.EventEx] [info] [System] [Datacenter] [11111111] [Hardware Sensor Status: Processor Green, Memory Green, Fan Green, Voltage Green, Temperature Green, Power Green, System Board Green, Battery Green, Storage Green, Other Green]" | ||
| }, | ||
| "expected": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T23:28:06.155764Z] [vim.event.EventEx] [info] [System] [Datacenter] [11111111] [Hardware Sensor Status: Processor Green, Memory Green, Fan Green, Voltage Green, Temperature Green, Power Green, System Board Green, Battery Green, Storage Green, Other Green]", | ||
| "event": { | ||
| "category": [ | ||
| "authentication" | ||
| ], | ||
| "code": "vim.event.EventEx", | ||
| "reason": "Hardware Sensor Status: Processor Green, Memory Green, Fan Green, Voltage Green, Temperature Green, Power Green, System Board Green, Battery Green, Storage Green, Other Green", | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "@timestamp": "2024-06-18T23:28:06.155764Z", | ||
| "host": { | ||
| "name": "Datacenter" | ||
| }, | ||
| "log": { | ||
| "level": "info" | ||
| }, | ||
| "observer": { | ||
| "product": "VCenter", | ||
| "vendor": "VMWare" | ||
| }, | ||
| "related": { | ||
| "user": [ | ||
| "System" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "user": { | ||
| "name": "System" | ||
| } | ||
| }, | ||
| "vmware_vcenter": { | ||
| "event_id": "11111111" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| { | ||
| "input": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T22:45:08.003776Z] [vim.event.UserLogoutSessionEvent] [info] [root\\example] [] [22222222] [User root\\[email protected] logged out (login time: Tuesday, 18 June, 2024 10:45:07 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)]" | ||
| }, | ||
| "expected": { | ||
| "message": "Event [11111111] [1-1] [2024-06-18T22:45:08.003776Z] [vim.event.UserLogoutSessionEvent] [info] [root\\example] [] [22222222] [User root\\[email protected] logged out (login time: Tuesday, 18 June, 2024 10:45:07 PM, number of API invocations: 2, user agent: VMware vim-java 1.0)]", | ||
| "event": { | ||
| "category": [ | ||
| "authentication" | ||
| ], | ||
| "code": "vim.event.UserLogoutSessionEvent", | ||
| "type": [ | ||
| "end" | ||
| ] | ||
| }, | ||
| "@timestamp": "2024-06-18T22:45:08.003776Z", | ||
| "host": { | ||
| "ip": "127.0.0.1" | ||
| }, | ||
| "log": { | ||
| "level": "info" | ||
| }, | ||
| "observer": { | ||
| "product": "VCenter", | ||
| "vendor": "VMWare" | ||
| }, | ||
| "related": { | ||
| "ip": [ | ||
| "127.0.0.1" | ||
| ], | ||
| "user": [ | ||
| "example" | ||
| ] | ||
| }, | ||
| "user": { | ||
| "domain": "root", | ||
| "name": "example" | ||
| }, | ||
| "user_agent": { | ||
| "device": { | ||
| "name": "Other" | ||
| }, | ||
| "name": "Other", | ||
| "original": "VMware vim-java 1.0", | ||
| "os": { | ||
| "name": "Other" | ||
| } | ||
| }, | ||
| "vmware_vcenter": { | ||
| "api_invocations": "2", | ||
| "event_id": "11111111", | ||
| "login_time": "Tuesday, 18 June, 2024 10:45:07 PM" | ||
| } | ||
| } | ||
| } |