Syslog Collector w/ File Connector Parsing Issue

Question

Dear all,
Recently, I had a requirement from a customer.
They have various Linux systems. They want to pass all syslog to
sentinel, but not by syslog connector for some reasons.
Therefore, they throw us those syslog in text file, and ftp it for
sentinel reading.
The problem is that this.RXBufferstring could not be 100% parsed in all
kinds of messages. Sometimes there would be error.
But when they use Syslog connector. Every event fields seem to be parsed
correctly.
So is there any methods to use syslog collector w/file connector
correctly?
Or how do people handle this kind of problem?
Please assist. Thanks a lot.
andy_ho
andy_ho's Profile: https://forums.netiq.com/member.php?userid=4568
View this thread: https://forums.netiq.com/showthread.php?t=51453

Answer 1

On 08/01/2014 04:26 AM, andy ho wrote:
>
> Dear all,
>
> Recently, I had a requirement from a customer.
>
> They have various Linux systems. They want to pass all syslog to
> sentinel, but not by syslog connector for some reasons.
> Therefore, they throw us those syslog in text file, and ftp it for
> sentinel reading.
>
> The problem is that this.RXBufferstring could not be 100% parsed in all
> kinds of messages. Sometimes there would be error.
> But when they use Syslog connector. Every event fields seem to be parsed
> correctly.
>
> So is there any methods to use syslog collector w/file connector
> correctly?
> Or how do people handle this kind of problem?
No supported way, no. The testing between collector and connector is done
so that certain methods are easy, reliable, and supported. Just because
data are grabbed from one media (network, syslog specifically) and written
to another (file) does not mean that nothing else is changed, and the
syslog collectors may be assuming other properties (such as the event
source IP address) are there when they are not.
You can probably make this work, but you'll likely need to customize the
collector in order to do it. The alternative is to use the debugging
feature of the collector to find out what is wrong with certain events and
possibly modify them on the event source side. Either way, you're going
to have a scenario that is not supported so it may be worth revisiting the
requirement to use a file vs. syslog just in case support matters more
than the "for some reasons" that they want to go with a file.
Good luck.
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...