Switch Construct

The Switch construct enables you to test several regular expression patterns sequentially to find a match. The format is:

<switch>
  <case>
    ...
  </case>
  <case>
    ...
  </case>
  <default>
    ...
  </default>
</switch>

Inside a Case, only regular expression match is allowed to see if execution will enter that case.

The following example illustrates a Switch statement. Suppose a log can follow two formats. We want to parse each format using a switch statement.

• Log 1: SSH session from 10.1.1.1 on interface Ethernet1 for user Joe terminated normally.

• Log 2: SSH session from 10.1.1.2 on interface Ethernet2 for user Bob disconnected by SSH server, reason: timeout expired.

The following switch statement accomplishes this.

<switch>
  <case>
    <collectFieldsByRegex src="$_body">
      <regex><![CDATA[SSH session from <srcIpAddr:gPatIpAddr> on interface <srcIntfName:gPatStr> for user "<user:gPatStrDQ>" terminated normally]]></regex>
    </collectFieldsByRegex>
    <setEventAttribute attr="eventType">ASA-315011-Logoff</setEventAttribute>
  </case>
  <case>
    <collectFieldsByRegex src="$_body">
      <regex><![CDATA[SSH session from <srcIpAddr:gPatIpAddr> on interface <srcIntfName:gPatStr> for user "<user:gPatStr>" disconnected by SSH server, reason:\s+"<errReason:gPatMesgBodyMin>"]]></regex>
    </collectFieldsByRegex>
  </case>
  <default/>
</switch>

For Log 1, the following values are parsed.

• srcIpAddr: 10.1.1.1

• srcIntfName: Ethernet 1

• user: Joe

For Log 2, the following values are parsed.

• SrcIpAddr: 10.1.1.2

• SrcIntfName: Ethernet 2

• user: Bob

• errReason: time out expired