Support for German Windows Versions
We are using German Windows versions on terminal servers and clients. Unfortunaltey Microsoft overeagerly translated the eventlogs, too and ArcSight decided that it shouldn't be ArcSight's problem if people outside the US insist in speaking other languages than English. This causes many errors about not parsable timestamps like
[ERROR][default.com.arcsight.agent.sdk.d.n][parseWithTokenParser] Unable to parse Date [Mi Dez 01 04:45:47 2010] with format [EEE MMM dd HH:mm:ss yyyy]
and the username is not being parsed correctly because it's "Benutzername" instead of "Username" which causes a lot of rules to fail.
To show ArcSight's appreciation even of those license $$s that once have been €€s ArcSight provides a documented way how I could localize my Windows connector by myself. Now I'm thinking that ArcSight has quite a few customers in Germany and it doesn't appear to be very sensible to have each of them localize the same connector. So my questions are:
- Has anybody created a localization file for Windows XP, 2003 and 2008 that works with the Snare connector?
And... would you be ready to share the localization file?
- Regarding a more longterm and supported solution: What do you think about ArcSight's policy to not localize parsers for a fairly common OS like Windows for languages with a notable customer base? While we're not allowed to see the parser where we could take a look which keywords need to be translated? And.. have you talked about your ArcSight contacts about this / also escalated this issue?
Re: Support for German Windows Versions
Yes, we do have the same problem, with French however.
It has been escalated also to HP that doesn't want to support other languages, or at least without getting some money out of it.
Note that in the ArcSight SmartConnectors and Localization.pdf, it is mentioned that German language is already supported by ArcSight SmartConnectors (page 4)