Highlighted
dstrevinas Trusted Contributor.
Trusted Contributor.
81 views

ArcSight TCP Connector CRLF line splitting

Hi board,

I wonder if anyone came across the same low-level issue.

I have a TCP SmartConnector listening on, say, TCP port 5000.

A have a custom tool sending multiline events to the connector.

The multiple lines on the same event are split with HEX 0D (carriage return).

Each multiline event is split from each other with HEX OD0A (carriage return / line feed)

--> So the problem right now is that the SmartConnector considers a new event even it is OD or ODOA, resulting in every line as new event.

Question: Do you happen to know if it is possible to somehow tell the connector to consider ODOA in the TCP Streams as a new event indicator???

 

Thanks,

Dimitris

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.