Hp

Overview

Aruba Networks is a subsidiary of Hewlett Packard Enterprise (HPE). HPE Aruba provides enterprise network access and switching hardware for wireless and wired network infrastructure. This app processes log messages from Aruba network devices to extract event information and create user tags for analysis.

App Function

The HP Aruba app performs the following functions:

1. Device Recognition: Identifies log messages from HP Aruba devices using two methods:

   • Numeric "program" field (Aruba Message ID)
   • Message text matching Aruba message templates

2. Message Processing: For recognized Aruba messages:

   • Changes "program" field to HP_Switch
   • Prepends Aruba event ID to log message text
   • Creates user tags based on event information

3. SSH Connection Tracking: For SSH/Telnet events, extracts source IP addresses and sets the SrcIP user tag

Vendor Documentation

• Aruba Support
• HPE Aruba Networking Support Services
• HP Aruba Troubleshooting
• Logmanager Documentation
• Aruba Central - How to Configure Logs and TFTP Dump Servers

Incoming Log Format

Aruba devices send log messages via standard syslog format. The message structure typically follows this pattern:

1. Primary timestamp and IP - Initial date-timestamp and IP address
2. Secondary timestamp and IP - Optional second pair (usually within seconds of primary)
3. Event ID - Aruba-specific numeric event identifier
4. Type code - Category identifier followed by colon
5. Event details - Descriptive text with event-specific information

Event details may contain IP addresses or port numbers, but data elements are not consistently delimited or positioned, making parsing challenging for unrecognized message types.

Parsed Metadata Fields

The HP Aruba app extracts the following information from log messages:

Standard Events:

• Aruba event ID (numeric identifier)
• Event category name (derived from event ID lookup)

SSH/Telnet Events:

• Source IP address of incoming connections

Log Examples

Incoming Telnet Connection

text
Wrap: OnCopyFullscreen
Jul  2 04:32:53 192.168.1.59  Jul  2 03:32:54 192.168.1.59
00179 mgr:  SME TELNET from 192.168.0.100 - MANAGER Mode

Port Going Off-Line

text
Wrap: OnCopyFullscreen
Jul  2 04:08:40 192.168.1.132  Jul  2 04:08:40 192.168.1.132
00077 ports:  port 4 is now off-line

Packet Errors

text
Wrap: OnCopyFullscreen
Jul  2 04:09:07 192.168.1.123 00327 FFI:  port 13-Excessive
undersized/giant packets. See help.

Aruba Categories