MonitorWare Knowledge Base

Can anyone provide me with info on the TCP message separation sequence in Winsyslog? I need to know if it possible to parse a TCP syslog message containing multiple syslog events, and forward each event as a single message. Nothing in the documentation (that I can find) or on the internet gives any detail about this feature, its capabilities, or even what the default value of \r\n represents. Any assistance is greatly appreciated.

Matt

Dear Matt,

technically any character sequence can be used as message separator. The default we normally use in WinSyslog is "\n" (a single line feed), not "\r\n" ( = carriage return line feed). If you use this separator, it should work. You will need to add this character sequence into the Forward Syslog Action, you are using to send the syslog messages to: %$LF%
So the full message format would be "%msg%%$LF%".

I hope this helps, best regards,
Andre Lorbach

Andre,

Thanks for the response. Can the message seperation sequence contain regular expressions?


Matt

Hi Matt,

I am afraid this is not possible. You can only use normal characters and the following special sequences:
\n for a line feed
\r for a carriage return
\0 for a NULL byte

I hope this helps - best regards,
Andre Lorbach