OK - there is a lot to unpick here.
- devicetime will be provided as millseconds since the epoch - so needs to be converted from str to float and then divided by 1000
- Be aware, if using the 'Test Execution" button - a NULL value will be sent, breaking everything
- It *is* most definitely possible to send syslog messages out of the ca jail. HOWEVER you should be aware of 2 things:
a) The *only* permitted connection to the host running the Custom Script itself is on port 443. Any other host - no restrictions.
b) There is no way to do DNS lookups - so you are stuckj with IP addresses as destinations.
- The 'syslog_message' string was incorrectly created - the hostname should not be followed by a colon, it should be followed by a space. Usually the next bit will be the TAG which *is* followed by a colon.
===
#!/usr/bin/env python
import socket
import time
import sys
from datetime import datetime
# Set the syslog server details
SYSLOG_SERVER = '10.10.10.10'
SYSLOG_PORT = 514
# Events Parameters
ACT_EVENT = sys.argv[1]
ACT_IP = sys.argv[2]
devicetime = sys.argv[3]
devicetime = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(float(devicetime) / 1000))
# Set the message details
MESSAGE = devicetime + ' ' + ACT_EVENT+ ' ' + ACT_IP + ' ' + 'Msg Terminated'
SEVERITY = 6
FACILITY = 1
# Create a socket connection to the syslog server
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
# Build the syslog message
timestamp = time.strftime('%b %d %H:%M:%S')
# hostname = socket.gethostname()
hostname = "tester"
syslog_message = '<{}>{} {} tag: {}'.format(
int(SEVERITY) + (int(FACILITY) * 8),
timestamp,
hostname,
MESSAGE
)
# Send the syslog message to the server
sock.sendto(syslog_message.encode(), (SYSLOG_SERVER, SYSLOG_PORT))
===
------------------------------
Paul Ford-Hutchinson
------------------------------
Original Message:
Sent: Sun May 07, 2023 05:09 AM
From: Nabil Nehme
Subject: Custom Action to send syslog message with event parameters
Greetings,
I am trying to use a custom script to send a Syslog message to an external server using the below python script.
The syslog message should include the devicetime retrieved from the event as a parameter:
import socket
import time
import sys
from datetime import datetime
# Set the syslog server details
SYSLOG_SERVER = 'SyslogIP'
SYSLOG_PORT = 514
# Events Parameters
ACT_EVENT = sys.argv[1]
ACT_IP = sys.argv[2]
devicetime = sys.argv[3]
devicetime = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(devicetime))
# Set the message details
MESSAGE = devicetime + ' ' + ACT_EVENT+ ' ' + ACT_IP + ' ' + 'Msg Terminated'
SEVERITY = 6
FACILITY = 1
# Create a socket connection to the syslog server
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
# Build the syslog message
timestamp = time.strftime('%b %d %H:%M:%S')
hostname = socket.gethostname()
syslog_message = '<{}>{} {}: {}'.format(
int(SEVERITY) + (int(FACILITY) * 8),
timestamp,
hostname,
MESSAGE
)
# Send the syslog message to the server
sock.sendto(syslog_message.encode(), (SYSLOG_SERVER, SYSLOG_PORT))
When I test the script I get the below error:
Traceback (most recent call last):
File "/custom_action_scripts/customaction_153.script", line 17, in <module>
devicetime = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(devicetime))
TypeError: a float is required
Any idea how can I fix this error?
Best
Nabil
------------------------------
Nabil Nehme
------------------------------