Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Anonymous_User Absent Member.
Absent Member.
332 views

Regarding universal collector and custom.js

Hello,

I have an event from Debian that I believe should be parsed by the
unix-common.js parse-postfix/smtpd method.

The trouble is that the events s_AppId has a backslash:

"s_AppId":"postfix\/smtpd",

I have tried to add the following prototype to custom.js that should
catch that s_AppId and then call the parse-postfix/smtpd method in
unix-common.js:

Record.prototype["parse-postfix\/smtpd"] = function(message, e) {


return this["parse-postfix/smtpd"](message, e);
};

It's not working, any idea what's wrong?

Thanks.

-alekz
0 Likes
3 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Regarding universal collector and custom.js


alekz;248913 Wrote:
> Hello,
>
> I have an event from Debian that I believe should be parsed by the
> unix-common.js parse-postfix/smtpd method.
>
> The trouble is that the events s_AppId has a backslash:
>
> "s_AppId":"postfix\/smtpd",
>
> I have tried to add the following prototype to custom.js that should
> catch that s_AppId and then call the parse-postfix/smtpd method in
> unix-common.js:
>
> Record.prototype["parse-postfix\/smtpd"] = function(message, e) {
>
>
> return this["parse-postfix/smtpd"](message, e);
> };
>
> It's not working, any idea what's wrong?
>
> Thanks.
>
> -alekz


can you attach the line from your connector dump?


--
brandon.langley
------------------------------------------------------------------------
brandon.langley's Profile: https://forums.netiq.com/member.php?userid=350
View this thread: https://forums.netiq.com/showthread.php?t=51788

0 Likes
Highlighted
Anonymous_User Absent Member.
Absent Member.

Re: Regarding universal collector and custom.js

{"s_AppId":"postfix\/smtpd","i_syslog_priority":"22","CONNECTION_METHOD":"SYSLOG","i_Hour":"21","i_RXBufferLength":"85","CONNECTION_MODE":"map","s_Process":null,"s_RV25":"E10D7AD0-219A-1032-A96C-000C29706422","s_RV24":"6E9BB0C0-18E4-1032-8504-000C29706422","i_Type":"2","i_Second":"19","s_RV23":"F4063910-1376-1032-90D6-BB936631E988","s_RV22":"9DD4D059-12A0-1032-AFB9-000C29706422","s_Version":"2011.1r4-201407092447-release","s_RXBufferString":"Sep
18 21:25:19 debian postfix\/smtpd[15887]: connect from
idm[192.168.0.6]","s_RV21":"C76D2820-C395-1029-BB86-001321B5C0B3","s_Body":"postfix\/smtpd[15887]:
connect from
idm[192.168.0.6]","s_chainId":"1411070554550","i_milliseconds":"1411068319000","s_raw_message2":"<22>Sep
18 21:25:19 debian postfix\/smtpd[15887]: connect from
idm[192.168.0.6]","s_MessageOriginatorPort":"34505","i_Minute":"25","s_Date":"Sep
18
21:25:19","i_TrustDeviceTime":"","i_DayOfMonth":"18","s_chainSequence":"484","i_Year":"2014","s_sha256Hash":"b4d34c9e660a3ec057f2a71461493c3c6a38058e02e96c95fa46b69b7a9e3f76","s_SyslogRelayIp":"192.168.0.4","s_MessageOriginatorHost":"debian","s_Pid":null,"i_Month":"8","i_syslog_facility":"2","i_syslog_severity":"6"}


On 2014-09-23 00:15, brandon.langley wrote:
>
> alekz;248913 Wrote:
>> Hello,
>>
>> I have an event from Debian that I believe should be parsed by the
>> unix-common.js parse-postfix/smtpd method.
>>
>> The trouble is that the events s_AppId has a backslash:
>>
>> "s_AppId":"postfix\/smtpd",
>>
>> I have tried to add the following prototype to custom.js that should
>> catch that s_AppId and then call the parse-postfix/smtpd method in
>> unix-common.js:
>>
>> Record.prototype["parse-postfix\/smtpd"] = function(message, e) {
>>
>>
>> return this["parse-postfix/smtpd"](message, e);
>> };
>>
>> It's not working, any idea what's wrong?
>>
>> Thanks.
>>
>> -alekz

>
> can you attach the line from your connector dump?
>
>

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Regarding universal collector and custom.js


alekz;249162 Wrote:
> {"s_AppId":"postfix\/smtpd","i_syslog_priority":"22","CONNECTION_METHOD":"SYSLOG","i_Hour":"21","i_RXBufferLength":"85","CONNECTION_MODE":"map","s_Process":null,"s_RV25":"E10D7AD0-219A-1032-A96C-000C29706422","s_RV24":"6E9BB0C0-18E4-1032-8504-000C29706422","i_Type":"2","i_Second":"19","s_RV23":"F4063910-1376-1032-90D6-BB936631E988","s_RV22":"9DD4D059-12A0-1032-AFB9-000C29706422","s_Version":"2011.1r4-201407092447-release","s_RXBufferString":"Sep
> 18 21:25:19 debian postfix\/smtpd[15887]: connect from
> idm[192.168.0.6]","s_RV21":"C76D2820-C395-1029-BB86-001321B5C0B3","s_Body":"postfix\/smtpd[15887]:
> connect from
> idm[192.168.0.6]","s_chainId":"1411070554550","i_milliseconds":"1411068319000","s_raw_message2":"<22>Sep
> 18 21:25:19 debian postfix\/smtpd[15887]: connect from
> idm[192.168.0.6]","s_MessageOriginatorPort":"34505","i_Minute":"25","s_Date":"Sep
> 18
> 21:25:19","i_TrustDeviceTime":"","i_DayOfMonth":"18","s_chainSequence":"484","i_Year":"2014","s_sha256Hash":"b4d34c9e660a3ec057f2a71461493c3c6a38058e02e96c95fa46b69b7a9e3f76","s_SyslogRelayIp":"192.168.0.4","s_MessageOriginatorHost":"debian","s_Pid":null,"i_Month":"8","i_syslog_facility":"2","i_syslog_severity":"6"}
>
>
> On 2014-09-23 00:15, brandon.langley wrote:
> >
> > alekz;248913 Wrote:
> >> Hello,
> >>
> >> I have an event from Debian that I believe should be parsed by the
> >> unix-common.js parse-postfix/smtpd method.
> >>
> >> The trouble is that the events s_AppId has a backslash:
> >>
> >> "s_AppId":"postfix\/smtpd",
> >>
> >> I have tried to add the following prototype to custom.js that should
> >> catch that s_AppId and then call the parse-postfix/smtpd method in
> >> unix-common.js:
> >>
> >> Record.prototype["parse-postfix\/smtpd"] = function(message, e) {
> >>
> >>
> >> return this["parse-postfix/smtpd"](message, e);
> >> };
> >>
> >> It's not working, any idea what's wrong?
> >>
> >> Thanks.
> >>
> >> -alekz

> >
> > can you attach the line from your connector dump?
> >
> >


Have you tried just Record.prototype["parse-postfix/smtpd"]? If you
run that dump through a JSON processor, that \ should go away because
it's just there to escape the slash, but isn't part of the actual value
when evaluated in code. JSON as a standard escapes slashes because of
its use in things like HTML, but should not be a problem inside a
collector.

Supporting knowledge in case anyone's curious:
http://tinyurl.com/an6zze2


--
brandon.langley
------------------------------------------------------------------------
brandon.langley's Profile: https://forums.netiq.com/member.php?userid=350
View this thread: https://forums.netiq.com/showthread.php?t=51788

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.