Juniper NETWORKS STRM - TECHNICAL NOTE REV 6-2008 Manual page 5

Table 4
provides a list of valid field names for use in the matcher field parameter (see
Table 3 ).
Table 4 Matcher Field Names
Field Name
EventName
(Required)
EventCategory
SourceIp
SourcePort
SourceIpPreNAT
SourceIpPostNAT
SourceMAC
SourcePortPreNAT
SourcePortPostNAT
DestinationIp
DestinationPort
DestinationIpPreNAT
DestinationIpPostNAT
DestinationPortPreNAT
DestinationPortPostNAT Specify the destination port for the message after NAT
DestinationMAC
DeviceTime
Understanding Extension Document Elements
Description
Specify the event name to be retrieved from the QID to
identify the event.
Specify an event category for any event with a category
not handled by an event-match-single entity or an
event-match-multiple entity.
Combined with EventName, EventCategory is used to
search for the event in the QID.
Specify the source IP address for the message.
Specify the source port for the message.
Specify the source IP address for the message before
Network Address Translation (NAT) occurs.
Specify the source IP address for the message after NAT
occurs.
Specify the source MAC address for the message.
Specify the source port for the message before NAT
occurs.
Specify the source port for the message after NAT occurs.
Specify the destination IP address for the message.
Specify the destination port for the message.
Specify the destination IP address for the message before
NAT occurs.
Specify the destination IP address for the message after
NAT occurs.
Specify the destination port for the message before NAT
occurs.
occurs.
Specify the destination MAC address for the message.
Specify the time that the event was sent, according to the
device (this is NOT the time that the event arrived).
STRM detects timestamps in the following formats:
Valid syslog timestamp in the form of mm dd hh:mm:ss,
•
for example:
Jan 13 12:33:10
Current locale timestamp
•
Any other formats will not properly convert.
5
Release 2008.2