Logger 5.5 bug? rawEvent exports rawMessage

[ekoeller@ameren1]

I upgraded the loggers to 5.5 this weekend and I believe there is a bug in the way logger exports events to a file.

We use rawEvent for a troubleshooting use case and have it enabled at the connector appliance.

Since upgrading to logger 5.5, when exporting the rawEvent, it actually exports the rawMessage instead of the rawEvent.  The rawMessage is in CEF and contains too much information for us to quickly troubleshoot network issues.

I submitted a service reqeust for this yesterday.

Here's my export screen showing All fields selected.  And below it is a screenshot of the exported .csv file showing the rawMessage in the rawEvent field.  You can tell that we have preserve rawEvent enabled because the CEF rawMessage field actually contains the rawEvent.

[sanhyongt1]

Hi Ed Koeller,

I can confirm this behaviour as well on software logger 5.5 P1.

Any confirmation from Support on this yet?

Edited: I have logged a case as well for this issue on software logger 5.5 P1. Hope to get this fixed soon.

Thanks.

[ekoeller@ameren1]

Hello
,

HP support asked me to patch to 5.5 patch 1 and see if the issue still exists.  I am working through our change management process to apply the patch, but I will report to them that you confirmed the same issue in patch 1.

[CBCJWINN1]

I'm also experiencing this problem.  My workaround for now is to add the following to the search string:

| rex "rawEvent=(?<RAW>.*)\scustomerURI="

It's not perfect, but at least I can work with the results in a CSV export using the new RAW field.  An escape "\" is added before some characters, such as "=".

[gportnoy1]

I just ran into this in 6.0, so safe to say this hasn't been fixed yet, unless you know of a workaround?  I need rawEvent it to submit a parser issue, i am sure support is going to have a ball with that. Should be fun.

[ekoeller@ameren1]

I tested this on 6.0 patch 1 and the issue still exists.  I requested an update on the support case I submitted.

[ekoeller@ameren1]

I was told by HP support that this is expected to be fixed in logger 6.1.

[sanhyongt1]

Thanks for the update, Ed Koeller.