TCP message separation sequence

Support, Questions and Discussions on WinSyslog

Moderator: alorbach

Google Ads


TCP message separation sequence

Postby Matteo » Mon Aug 25, 2008 11:17 pm

Can anyone provide me with info on the TCP message separation sequence in Winsyslog? I need to know if it possible to parse a TCP syslog message containing multiple syslog events, and forward each event as a single message. Nothing in the documentation (that I can find) or on the internet gives any detail about this feature, its capabilities, or even what the default value of \r\n represents. Any assistance is greatly appreciated.

Matt
Matteo
New
 
Posts: 3
Joined: Mon Aug 25, 2008 10:59 pm

Re: TCP message separation sequence

Postby alorbach » Tue Aug 26, 2008 11:03 am

Dear Matt,

technically any character sequence can be used as message separator. The default we normally use in WinSyslog is "\n" (a single line feed), not "\r\n" ( = carriage return line feed). If you use this separator, it should work. You will need to add this character sequence into the Forward Syslog Action, you are using to send the syslog messages to: %$LF%
So the full message format would be "%msg%%$LF%".

I hope this helps, best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: TCP message separation sequence

Postby Matteo » Tue Aug 26, 2008 3:21 pm

Andre,

Thanks for the response. Can the message seperation sequence contain regular expressions?


Matt
Matteo
New
 
Posts: 3
Joined: Mon Aug 25, 2008 10:59 pm

Re: TCP message separation sequence

Postby alorbach » Tue Aug 26, 2008 3:46 pm

Hi Matt,

I am afraid this is not possible. You can only use normal characters and the following special sequences:
\n for a line feed
\r for a carriage return
\0 for a NULL byte

I hope this helps - best regards,
Andre Lorbach
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Google Ads



Return to WinSyslog

Who is online

Users browsing this forum: No registered users and 0 guests

cron