Package cisco/ios Release Notes

Package cisco/ios Release Notes Version 1.7.0

  • Added support for additional log formats including ACCOUNTING events and IGMP logs

  • Enhanced access list log parsing to support both denied and permitted traffic

  • Added support for timezone-specific timestamp parsing

  • Updated to ECS version 9.0.0

  • Updated parser version to 2.6.0

Package cisco/ios Release Notes Version 1.6.1

  • Added support for VTY access logs with new pattern matching

Package cisco/ios Release Notes Version 1.6.0

  • Enhanced event type categorization for more accurate event classification

  • Added support for additional Cisco IOS event codes including SGACLHIT, FAIL, DHCP_SNOOPING_DENY, and more

  • Improved MAC address normalization for better consistency

  • Added deduplication of event categories and types

Package cisco/ios Release Notes Version 1.5.1

  • Removed test cases

Package cisco/ios Release Notes Version 1.5.0

  • Improved timestamp parsing for formats including year in different positions

  • Added support for MAC address extraction and normalization

  • Enhanced access list log parsing to handle MAC addresses in source fields

  • Added parsing for CFGLOG_LOGGEDCMD events to capture CLI commands

Package cisco/ios Release Notes Version 1.4.0

  • Improved regex pattern for broader raw log coverage

  • Added timestamp parsing support for formats including year

  • Added LOGIN_FAILED eventCode parsing

  • The old parser syslog-utc is now officially removed from the Cisco IOS package

  • Utilized array:append() function for array declarations.

Package cisco/ios Release Notes Version 1.3.0
Parser renaming and Deprecation notice

The old parser syslog-utc is deprecated, and replaced by the new parser cisco-ios . While the old parser will remain available during a tranisition period, all future changes will only go into the new cisco-ios parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old syslog-utc parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

Duplicated vendor fields dropped in new parser

The old syslog-utc parser would duplicate certain fields, which the new cisco-ios parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp ), and as a field mapped to CPS (e.g. source.ip ). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:

  • Vendor.eventAction

  • Vendor.ios.message_count

  • Vendor.ios.sequence

Package cisco/ios Release Notes Version 1.2.0

  • Improves the timestamp parsing.

Package cisco/ios Release Notes Version 1.1.0

  • Improves the field extraction and performance.

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

  • Sets the event.category , event.type and event.outcome fields based on type of the event.

  • Adds the observer.type and event.kind fields.

  • Dropps the event.provider field.

Package cisco/ios Release Notes Version 1.0.0

  • Adds new event.module and Cps.version fields

  • Removes the Product , related.user and related.ip fields

  • Sets following tags: Cps.version , Vendor , ecs.version , event.dataset , event.kind , event.module , event.outcome , observer.type