Parsing failure in Splunk for PAM syslog messages with ampersand characters

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A Splunk automation to trigger a workflow when a password view request is received from PAM fails when the requestor uses an ampersand ('&')in the Reason Description field. PAM is configured with message format Space Delimited on the Configuration > Logs > Syslog page.

Review of all PAM syslog messages received by Splunk shows that the request is received, but with the default XML format rather than the configured Space Delimited format. The automation is configured to parse space delimited messages and doesn't recognize the XML messages as password view requests.

Environment

CA Privileged Access Manager (PAM) 4.3.1 integrated with Splunk. The 4.2.x and 4.3.0 releases are affected as well.

PAM configured to use message format Space Delimited or JSON.

Cause

The ampersand character, even after correct XML encoding to '&', causes a parsing error in a class that PAM uses to convert the XML message to the configured Space Delimited or JSON format. This causes the message to be send with the original XML format.

Resolution

This problem is resolved in the 4.3.1.01 Hotfix.

Additional Information

If you observe this problem on a release lower than 4.3.1 and need to have it fixed before your next upgrade, contact Support.