MonitorWare Knowledge Base

When we forward contents of texts using some logger implementations the Interactive Server does not show the entry properly and accurately.

Example of what the Interactive Server could not handle:
------------------------------------------------------------
2004-01-12 18:03:04 09:03:04 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/ ... nifest.asp
2004-01-12 18:03:04 09:03:04 Success IUENGINE Determining machine configuration
2004-01-12 18:03:05 09:03:05 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/ ... nifest.asp
2004-01-12 18:03:05 09:03:05 Success IUENGINE Determining machine configuration
2004-01-12 18:03:05 09:03:05 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/ ... nifest.asp
2004-01-12 18:03:06 09:03:06 Success IUENGINE Determining machine configuration
2004-01-12 18:03:07 09:03:07 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/ ... nifest.asp
2004-01-12 18:03:08 09:03:08 Success IUENGINE Shutting down
2004-01-12 18:03:08 09:03:08 Success IUCTL Shutting down
------------------------------------------------------------

What is shown as buggy outputs: the starting "2004" duplicates and show as "20042004-01-12" in the example above.

Environment: Windows Server 2003 Standard JP+WinSyslog 4.2 through 5.2 (With default settings)

Reproduce: ALWAYS

selected language of the Interactive Server GUI: either English or Japanese, at least.

Sounds strange. Thanks for telling us about this problem.
My college will set this up in a test lab for further analyzis. I will answer to this thread again later then.

regards,
Andre

Hello,

I set up an Win2k3 Server in a Testlab and tried to reproduce this issue but I couldn't reproduce it yet. . . . . .
Could you please tell us a little more about your settings/configuration ?

Regards,
Timm Herget

Hi. I use the following application to send the contents of a text-formatted log to syslog. It can be anything, as long as the app sends what is written in a text file to syslog.
http://winlogmon.sourceforge.jp/

I am monitoring on the text log files like:
* Windows Update log
* setupapi.log
* MySQL error file
* Apache2 (win32) error and stdout log files

I checked the logs that this application records and the original source of the text logs. There seems no problem among them. The trouble seems to occur after winsyslog engine receives the message and then forward to the interactive syslog server.

I also verified this using kiwi, MTsyslog (from MikroTik), and some CLI implementations of syslogd.

YamaKen wrote:I also verified this using kiwi, MTsyslog (from MikroTik), and some CLI implementations of syslogd.

So you mean the same problem happens with other Syslgo deamons as well?

For further testing, could you create another Rule with a File Logging Action and only enable the "Include Message" option. Or switch the FIle Format to Custom and leave everything else default.

Then review the logfile and check if the problem exists there as well.

I confirmed this behavior is unique with the Interactive server, not Winsyslog itself or other implementations.

What I said previously was just saying that there is no problem handling this message as for other syslog servers. Just the Interactive server has troubles.

The actual log entry is like this (I took this with Winsyslog)
------------------------------------------------------------
2004-06-09,09:16:05,2004-06-09,09:16:05,192.168.1.166,1,1,[logmon03]2004-06-09 09:16:05+0900 1388 158 Cleared the proxy cache.
------------------------------------------------------------

What is shown in the Interactive server:
------------------------------------------------------------
2004/06/09 9:15:33, 0, 6, 127.0.0.1, Jun 9 09:15:33 127.0.0.1 20042004-06-09
------------------------------------------------------------

As for other syslog servers I repeat there is no problem. It logged what I showed several lines above with Winsyslog.