Eltex MES Switch Syslog

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-eltex-mes/generator.yml \
  --id mes \
  --live-mode true

Event Types

Realism Features

• One switch with 24 ports: twenty access ports with 64 MAC addresses each and four dual-rate 1G/10G server ports with three each, configured for 10G. About 900 messages an hour (±5% from hour to hour) at random moments around the clock, with no daily cycle. Every endpoint, port and administrator follows its own random schedule, with no fixed period, rotation or global wave.
• Each MAC address is learnt and later removed by aging after lognormal present and absent times; a Down removes every present address of that port one by one, and the addresses are learnt again after Up. Ports flap on their own (Up after seconds to minutes), and administrators also shut ports down and re-enable them.
• Two automation accounts log in over HTTPS from their own addresses and change nothing: nms-backup about every hour, nms-poll about every ten minutes, each cycle a few percent early or late. They make up most logins and almost never fail.
• Six administrator accounts log in over HTTPS: the shared admin and noc-duty accounts, used by several NOC engineers, about every one and a half to two and a half hours each, and four personal accounts about twice a day. Mistyped passwords come mostly from the shared accounts, on every day; a single failure is the most common, each longer run up to four in a row is rarer, and consecutive failures stay below a lockout threshold of 5. About 8% of login attempts fail. An ordinary session changes something only now and then, usually a port shutdown and re-enable; changed state is restored within the session or by the next administrator to log in.
• About three days in ten carry planned work: most shared-account sessions that day are change sessions, whose login often starts with mistyped passwords after a password rotation and which set a server port to 1G, clear the logging file and remove the auxiliary receiver, usually in that order, before the changes are restored. A typical change day has about 182 logins, 26 failed logins, 37 speed changes, 15 file clears and 9 receiver removals; another day about 185, 12, 9, 1.7 and 1.1. Rates, durations and operation mix are synthetic workload choices, not measured Eltex production frequencies.
• Message bodies only: the catalog carries no firmware version, and no syslog priority, timestamp, hostname or transport framing is emitted; observer.model and the parsed eltex.mes.details fields are normalization. The learnt form comes from the catalog parameter table, so its live capitalization is unconfirmed. Console, Telnet and SSH sessions are not modeled. Configuration lines name no user, so linking them to a login is temporal only. Messages the switch writes within milliseconds appear seconds apart: a Down follows its speed change after a median of 3.0 s, and the MAC removals after an access port Down take a median of 3.3 minutes. No live capture, exact-build trace or maintained Elastic integration for Eltex MES was available for comparison.

Sample Output

{
  "@timestamp": "2026-09-02T21:18:31.319+00:00",
  "destination": {
    "ip": "10.40.0.11"
  },
  "ecs": {
    "version": "8.17.0"
  },
  "eltex": {
    "mes": {
      "component": "AAA",
      "details": {
        "connection": {
          "auth_method": "local user table",
          "type": "https"
        }
      },
      "mnemonic": "REJECT",
      "severity_code": "W"
    }
  },
  "event": {
    "action": "login_rejected",
    "category": [
      "authentication"
    ],
    "dataset": "eltex.mes.syslog",
    "kind": "event",
    "module": "eltex",
    "original": "AAA-W-REJECT: New https connection for user noc-duty, source 10.40.1.12 destination 10.40.0.11, local user table REJECTED.",
    "outcome": "failure",
    "type": [
      "start",
      "denied"
    ]
  },
  "log": {
    "level": "warning"
  },
  "message": "AAA-W-REJECT: New https connection for user noc-duty, source 10.40.1.12 destination 10.40.0.11, local user table REJECTED.",
  "observer": {
    "hostname": "mes-access-01",
    "ip": [
      "10.40.0.11"
    ],
    "model": "MES5324",
    "name": "mes-access-01",
    "product": "MES",
    "type": "switch",
    "vendor": "Eltex"
  },
  "source": {
    "ip": "10.40.1.12"
  },
  "user": {
    "name": "noc-duty"
  }
}

Parameters