Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASimWebSessionSquidProxy issue with data from AMA #11268

Open
gitjpk opened this issue Oct 14, 2024 · 0 comments
Open

ASimWebSessionSquidProxy issue with data from AMA #11268

gitjpk opened this issue Oct 14, 2024 · 0 comments
Assignees
Labels
Connector Connector specialty review needed

Comments

@gitjpk
Copy link

gitjpk commented Oct 14, 2024

Describe the bug
The parser does not work correctly with data coming AMA connector.

To Reproduce
Execute the parser against Syslog data collected with AMA.

Expected behavior
Parse the data

Additional context
Basically, we installed Custom logs via AMA data connector on a “default configured” Squid proxy, using AMA version 1.33.1.0, and we planned to use the “Web Session Essentials Workbook”.
Data filled in the right table with no issue (Squidproxy_CL) but the workbook did not get any data (and we configured the logic apps, same issue).
Troubleshooting the issue, we went through _Asim_WebSession(), then _Im_WebSessionBuiltIn(), then _Im_WebSession_SquidProxyV06, we found a few errors in the last one.
On line 32, it’s expecting a computer field which does not exist in the table:
Dvc = Computer
On line 88, it’s projecting away a few field that don’t exist in the table;:
| project-away AccessRawLog, RawData, *_s, MG, ManagementGroupName, SourceSystem, TenantId, DstIpAddrIsHost
For testing purpose, we added the following transformation rule in the DCR :
source | extend Computer="FakeComputerName", MG="MG", ManagementGroupName="ManagementGroupName", SourceSystem="SourceSystem"
We then saw data in the workbook 😊

@v-rusraut v-rusraut added the Connector Connector specialty review needed label Oct 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Connector Connector specialty review needed
Projects
None yet
Development

No branches or pull requests

3 participants