Community in read only mode June 18 & 19
This community will be set in READ ONLY mode for a while on Tuesday June 18 into Wednesday June 19 while we import content and users from our Micro Focus Forums community site. MORE INFORMATION
Highlighted
Micro Focus Expert
Micro Focus Expert
617 views

WinC - Know your locales

Hi Folks,

Due to my recent struggle just want to get you aware that the new Microsoft Windows Event Log -- Native SmartConnector does not support any other Windows locale setting besides English right now.

If you try to get the event log from a Windows system that is using a different locale (like german, russian), you might see the following error in the agent.log:

[2015-04-29 14:30:59,843][ERROR][default.com.arcsight.agent.winc.k][setTimeCreated] Failed to convert time [0] to long value

[2015-04-29 14:30:59,843][ERROR][default.com.arcsight.agent.winc.k][setTimeCreated]

java.text.ParseException: Unparseable date: "29.04.2015 14:30:45"

  at java.text.DateFormat.parse(DateFormat.java:357)

  at com.arcsight.agent.winc.k.c(k.java:220)

  at com.arcsight.agent.winc.f.b.a(b.java:333)

  at com.arcsight.agent.winc.f.b.a(b.java:170)

  at com.arcsight.common.mq.c.f.e(f.java:46)

  at com.arcsight.common.mq.c.e.run(e.java:42)

  at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)

  at java.util.concurrent.FutureTask.run(FutureTask.java:262)

  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

  at java.lang.Thread.run(Thread.java:745)

[2015-04-29 14:30:59,843][ERROR][default.com.arcsight.agent.winc.k][setTimeCreated] Failed to convert time [0] to long value

However: The events still get parsed and you may be successful by changing the time settings on your systems, But as long as it's unsupported, you have to be careful using it this way.

There's already Feature Request CON-15362 open for adding localization support for Japan, Chinese and French language. Hopefully other languages will follow soon.

Unfortunately, this is not documented in the Configuration Guide right now.

Watch out!

- Tobias

Labels (2)
4 Replies
nils.guenther@t Honored Contributor.
Honored Contributor.

Re: WinC - Know your locales

Hi Tobias,

Thanks for that reminder. I am facing the prob on a "germanized" Windows 20012.

The following is only partially true:

>>However: The events still get parsed

Due to the parsing error for TimeCreated the Start- and End Time in the event are set to device reciept time. This is more than slightly wrong under certain circumstances.

francois.devare Contributor.
Contributor.

Re: WinC - Know your locales

Hi,

Did someone created a parser override to fix this error?

0 Likes
francois.devare Contributor.
Contributor.

Re: WinC - Know your locales

Hi,

The information was written in this presentation :

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: WinC - Know your locales

Just a quick update,

this bug has been fixed with SmartConnector version 7.1.4

CON-15610

Microsoft Windows Event Log – Native 

The dates for non-English locales were not being parsed. This issue has been fixed.

Source:

I tested the new version - the dates are now parsed correctly.

- Tobias

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.