MonitorWare Knowledge Base

hi again,
I am moving log files from a windows based box into a syslog server, each of the events in these log files have a timestamp on them but when i send them across to the syslog server the present time shows up and not the original timestamp at which the event occured.

Waiting eagerly for ur reply

Regards
Jcoder

Hi,

you want the original timestamp of the EventLog Message to become the first timestamp in the Syslog message?
I am afraid this will not be possible. But the original TimeStamp can be added into the message by using a custom message format like this (in the Syslog Action):

Code: Select all

Time: %timegenerated% - Message: %msg%

regards,
Andre Lorbach

hi,
Thanks for the prompt reply, that partly solves my problem. I was using a single monitorware agent to get the log files into the syslog server i have and the syslog server shows the log files to be coming from a single source ( the machine ip on which the central monitorware is located), i was wondering if the monitorware could preserve a host stamp of the computers where the data was being monitored by it and send this as a host stamp along with the log files it forwards to the syslog server.

Regards
Jcoder

Hello,

Could you please tell us what you mean with "hoststamp"?
And what kind of logs are your "log files"? Are these text file logs or windows event logs?

We will take care of this, but need this information.

Regards,
Florian Riedl

hi,
These are test file based logs generated by a jboss application server.

Regards
jcoder

Ok, so to get this right:

You have text file logs created by your jboss application server. You want these logs to be forwarded by MonitorWare Agent (File Monitor) to a syslog server. The syslog message you receive should have the IP or hostname of the messages origin server as the sender.

Is this correct so far?

Could you please be so kind and send us some sample logs of jboss application server, so we can take a look into it?
Please compress them (zip, rar, tar.gz) and upload them to our anonymous ftp at hetzner.adiscon.com. Be sure to change to the /incoming directory!

Regards,
Florian Riedl