Netflow issue when cisco ASA is sending messages

mariusgeonea · April 20, 2018, 7:31am

Hello,

I have configured a CISCO ASA device to send netflow logs to Graylog, when I click on show received messages i don’t see anything, but the packets are comming in. I have seen that many people have this issue have you managed to fix this with a new plugin?

Thanks,
Marius.

jan · April 20, 2018, 8:49am

Did you checked the time set on your ASA?

mariusgeonea · April 20, 2018, 11:15am

does the time on ASA needs too match the time on Graylog?

jan · April 20, 2018, 11:24am

To answer your question short - no.

@mariusgeonea it should be the same time in your complete environment. That would easy up everything. But I just guessed that your data is send with a timestamp somewhere in the past or in the future. That should be something you might want to check.

mariusgeonea · April 20, 2018, 12:05pm

i did a search in all messages regarding that input in the last 2 days and nothing worked…

dustintennill · April 20, 2018, 8:54pm

I believe we had this configured for our routers, but not ASA’s. Going to see if that worked for us, will get back in a bit.

mariusgeonea · April 21, 2018, 7:47am

for routers works excellent, but for ASA nothing appears. and I think that the problem is with the version of netflow. cisco routers send v5 and ASA send v9. in theory the plugin for the netflow input should work with v9 but for some reason it doesn’t it’s a bit frustrating, but it is what it is…

maybe the graylog team will manage to do something to fix, who knows…

jtkarvo · April 21, 2018, 2:33pm

If your input is a syslog input, try a raw input instead and see if you get the messages.

mariusgeonea · April 21, 2018, 4:30pm

From Asa I’m sending netflow, asa sends only netflow v9 btw, în graylog I have the netflow input. I’m receiving the packets but they are not displayed.

jan · April 22, 2018, 5:33pm

what Version of the Plugin and Graylog did you use?

It would be great if you can contribute some netflow data to us that we can verify and test. You must know that we build everything only based on data users provided to us or we found somewhere. No Vendor was every in direct contact with us or gave us hardware or software we can test with.

mariusgeonea · April 23, 2018, 9:02am

Hi Jan,

i have to cisco ASA sending netflow to graylog(one is running the IOS version 9.5.2 and the other one 9.4 )
the graylog version is Graylog v2.4.3+2c41897, and the plugin version is graylog-plugin-netflow-2.4.3.jar

i have the capture from the graylog serve(pcap fromat) but it says that i’m not authorized to upload anything, so i have no idea how can i give you this…

Thanks,
Marius

mariusgeonea · April 23, 2018, 9:03am

*i have two cisco ASA

jochen · April 23, 2018, 9:07am

Is there anything interesting in the logs of your Graylog node?
Have you tried using Logstash’s Netflow codec to receive the packets and forward them to Graylog?

You could upload the pcap files into Dropbox, Google Drive, or a similar service and share a link.

mariusgeonea · April 23, 2018, 9:30am

Hi Jochen,

i don’t wanna be rude, and i hope it will not sound like i’m rude.
but here is the thing, this is the 2nd time you are replying me, that a workarround is logstash. i know that works till the logstash server crashes or something happens to it.
but then again, if i would want to extensively use logstash for feeding graylog i won’t use graylog at all, i would use ELK right? because if i would run logstash it’s better to runn it kibana and not graylog.

I understand that Graylog is free, and with free support I really appreciate this, but the thing is that if you put a plugin in graylog and you say it should work, then it should work i also understand that no vendor want’s to work too much with Graylog team, because they can’t really partner with you for “money” reasons, they choose often to partner with those which sell products to create more money, this is how the industry works.

Anyway if you can’t fix that netflow plugin that is ok, but if graylog team would manage to fix it or somebody else it would be really nice.

More than this it seems i’m not the only one which complained about the netflow issue when ASA sends the netflow logs…

you can find the pcap link here https://drive.google.com/file/d/1lBE54ACuIlyYNAWARBhJA7AVsNXA7lc2/view?usp=sharing

Thanks,
Marius.

mariusgeonea · April 23, 2018, 10:49am

Hi Jochen,

i have forgot about the logs from graylog

here they are.

Thanks,
Marius.

2018-04-22T10:34:55.057-04:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=531235f0-463a-11e8-9b7c-000c2954fe77, journalOffset=4675781, codec=netflow, payloadSize=414, timestamp=2018-04-22T14:34:55.055Z, remoteAddress=/10.17.248.2:46664} on input <5ad97fa6a8b62b32a579949b>.
2018-04-22T10:34:55.060-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=531235f0-463a-11e8-9b7c-000c2954fe77, journalOffset=4675781, codec=netflow, payloadSize=414, timestamp=2018-04-22T14:34:55.055Z, remoteAddress=/10.17.248.2:46664}
java.lang.NullPointerException: null
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessageString(NetFlowFormatter.java:54) ~[?:?]
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessage(NetFlowFormatter.java:119) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$2(NetFlowCodec.java:160) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:175) ~[?:1.8.0_161]
at java.util.Collections$2.tryAdvance(Collections.java:4717) ~[?:1.8.0_161]
at java.util.Collections$2.forEachRemaining(Collections.java:4725) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$3(NetFlowCodec.java:161) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeV9(NetFlowCodec.java:163) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeMessages(NetFlowCodec.java:134) ~[?:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:148) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-04-22T10:35:00.670-04:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=566a88b0-463a-11e8-9b7c-000c2954fe77, journalOffset=4675917, codec=netflow, payloadSize=387, timestamp=2018-04-22T14:35:00.667Z, remoteAddress=/10.17.248.2:46664} on input <5ad97fa6a8b62b32a579949b>.
2018-04-22T10:35:00.670-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=566a88b0-463a-11e8-9b7c-000c2954fe77, journalOffset=4675917, codec=netflow, payloadSize=387, timestamp=2018-04-22T14:35:00.667Z, remoteAddress=/10.17.248.2:46664}
java.lang.NullPointerException: null
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessageString(NetFlowFormatter.java:54) ~[?:?]
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessage(NetFlowFormatter.java:119) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$2(NetFlowCodec.java:160) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:175) ~[?:1.8.0_161]
at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:948) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$3(NetFlowCodec.java:161) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeV9(NetFlowCodec.java:163) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeMessages(NetFlowCodec.java:134) ~[?:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:148) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-04-22T10:35:09.005-04:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=5b6281b0-463a-11e8-9b7c-000c2954fe77, journalOffset=4676089, codec=netflow, payloadSize=610, timestamp=2018-04-22T14:35:09.003Z, remoteAddress=/10.17.248.2:46664} on input <5ad97fa6a8b62b32a579949b>.
2018-04-22T10:35:09.005-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=5b6281b0-463a-11e8-9b7c-000c2954fe77, journalOffset=4676089, codec=netflow, payloadSize=610, timestamp=2018-04-22T14:35:09.003Z, remoteAddress=/10.17.248.2:46664}
java.lang.NullPointerException: null
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessageString(NetFlowFormatter.java:54) ~[?:?]
at org.graylog.plugins.netflow.flows.NetFlowFormatter.toMessage(NetFlowFormatter.java:119) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$2(NetFlowCodec.java:160) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:175) ~[?:1.8.0_161]
at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:948) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.lambda$decodeV9$3(NetFlowCodec.java:161) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_161]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeV9(NetFlowCodec.java:163) ~[?:?]
at org.graylog.plugins.netflow.codecs.NetFlowCodec.decodeMessages(NetFlowCodec.java:134) ~[?:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:148) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-04-22T10:35:14.818-04:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=5ed958f0-463a-11e8-9b7c-000c2954fe77, journalOffset=4676227, codec=netflow, payloadSize=930, timestamp=2018-04-22T14:35:14.815Z, remoteAddress=/10.17.248.2:46664} on input <5ad97fa6a8b62b32a579949b>.
2018-04-22T10:35:14.818-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=5ed958f0-463a-11e8-9b7c-000c2954fe77, journalOffset=4676227, codec=netflow, payloadSize=930, timestamp=2018-04-22T14:35:14.815Z, remoteAddress=/10.17.248.2:46664}

jochen · April 23, 2018, 11:01am

For reference:
https://github.com/Graylog2/graylog-plugin-netflow/issues/30

mariusgeonea · April 23, 2018, 11:07am

so, what is the solution then?

jochen · April 23, 2018, 11:11am

Subscribe to the referenced issue on GitHub to get notified when it’s being fixed.

mariusgeonea · April 23, 2018, 11:13am

ok, thanks

system · May 7, 2018, 11:13am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Graylog 2.4.6+ceaa7e4 and Cisco ASA Netflow Graylog Central (peer support)	6	1190	December 7, 2018
NetFlow Configuration Graylog Central (peer support)	4	6999	February 6, 2019
Problem with Netflow Cisco ASR 1001-x Graylog Central (peer support)	9	3970	June 21, 2018
GrayLog Netflow v9 with Cisco Router High Speed Logging Graylog Central (peer support)	2	1770	May 6, 2020
Graylog 3 only one source Graylog Central (peer support)	7	1103	April 23, 2019

Netflow issue when cisco ASA is sending messages

Related Topics