Tobias1 Absent Member.
Absent Member.

Support for German Windows Versions


We are using German Windows versions on terminal servers and clients. Unfortunaltey Microsoft overeagerly translated the eventlogs, too and ArcSight decided that it shouldn't be ArcSight's problem if people outside the US insist in speaking other languages than English. This causes many errors about not parsable timestamps like

[ERROR][][parseWithTokenParser] Unable to parse Date [Mi Dez 01 04:45:47 2010] with format [EEE MMM dd HH:mm:ss yyyy]

and the username is not being parsed correctly because it's "Benutzername" instead of "Username" which causes a lot of rules to fail.

To show ArcSight's appreciation even of those license $$s that once have been €€s ArcSight provides a documented way how I could localize my Windows connector by myself. Now I'm thinking that ArcSight has quite a few customers in Germany and it doesn't appear to be very sensible to have each of them localize the same connector. So my questions are:

  1. Has anybody created a localization file for Windows XP, 2003 and 2008 that works with the Snare connector?
    And... would you be ready to share the localization file?
  2. Regarding a more longterm and supported solution: What do you think about ArcSight's policy to not localize parsers for a fairly common OS like Windows for languages with a notable customer base? While we're not allowed to see the parser where we could take a look which keywords need to be translated? And.. have you talked about your ArcSight contacts about this / also escalated this issue?



Labels (1)
1 Reply
OBSCyril Frequent Contributor.
Frequent Contributor.

Re: Support for German Windows Versions

Hello Tobias,

Yes, we do have the same problem, with French however.

It has been escalated also to HP that doesn't want to support other languages, or at least without getting some money out of it.

Note that in the ArcSight SmartConnectors and Localization.pdf, it is mentioned that German language is already supported by ArcSight SmartConnectors (page 4)


The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.