Solved

How to modify Windows Servers events from multiline to a single line format

Posted on 2015-01-12
6
75 Views
Last Modified: 2015-02-12
Hello,

We have about 900 Windows servers which are being indexed by our single logging system(splunk enterprise server). We are then forwarding these server logs in a standard syslog format to a 3rd party system. The 3rd party system perceives the logs in a multiline format. We need to convert them to single line because they do not support multiline.

Here is an event example from the 3rd party system:

    Dec 29 07:47:18 172.25.32.44 12/29/2014 02:47:17 AM
    Dec 29 07:47:18 172.25.32.44 LogName=Security
    Dec 29 07:47:18 172.25.32.44 SourceName=Microsoft Windows security auditing.
    Dec 29 07:47:18 172.25.32.44 EventCode=4689
    Dec 29 07:47:18 172.25.32.44 EventType=0
    Dec 29 07:47:18 172.25.32.44 Type=Information
    Dec 29 07:47:18 172.25.32.44 ComputerName=MYSERVER.dev.ad
    Dec 29 07:47:18 172.25.32.44 TaskCategory=Process Termination
    Dec 29 07:47:18 172.25.32.44 OpCode=Info
    Dec 29 07:47:18 172.25.32.44 RecordNumber=9663387
    Dec 29 07:47:18 172.25.32.44 Keywords=Audit Success
    Dec 29 07:47:18 172.25.32.44 Message=A process has exited.
    Dec 29 07:47:18 172.25.32.44 Subject:
    Dec 29 07:47:18 172.25.32.44 Security ID: NT AUTHORITY\LOCAL SERVICE
    Dec 29 07:47:18 172.25.32.44 Account Name: LOCAL SERVICE
    Dec 29 07:47:18 172.25.32.44 Account Domain: NT AUTHORITY
    Dec 29 07:47:18 172.25.32.44 Logon ID: 0x3e5
    Dec 29 07:47:18 172.25.32.44 Process Information:
    Dec 29 07:47:18 172.25.32.44 Process ID: 0xa84
    Dec 29 07:47:18 172.25.32.44 Process Name: D:\Program Files (x86)\Citrix\HealthMon\Tests\Citrix\RequestTicket.exe
    Dec 29 07:47:18 172.25.32.44 Exit Status: 0x0
     
     

How can we go about modifying the feed/events from a standard multiline format to a single line format?

I was told perhaps using regex to change the line breaks to some other delimiter could work.

Please advise as to how we can mod the multiline format to single line format?

--
Please advise if you need more details

Many thanks,

T
0
Comment
Question by:tobe1424
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 84

Expert Comment

by:ozo
ID: 40545590
What should the single line format look like?
0
 

Author Comment

by:tobe1424
ID: 40549266
It took a while for me to obtain the format from my team. Here is how it should look:

Dec 29 07:47:18 172.25.32.44 12/29/2014 02:47:17 AM LogName=Security; SourceName=Microsoft Windows security auditing.; EventCode=4689; EventType=0; Type=Information; ComputerName=MYSERVER.dev.ad; TaskCategory=Process Termination; OpCode=Info; RecordNumber=9663387; Keywords=Audit Success; Message=A process has exited.; Subject=; Security ID=NT AUTHORITY\LOCAL SERVICE; Account Name=LOCAL SERVICE; Account Domain=NT AUTHORITY; Logon ID=0x3e5; Process Information=; Process ID=0xa84; Process Name=D:\Program Files (x86)\Citrix\HealthMon\Tests\Citrix\RequestTicket.exe; Exit Status=0x0

--

T
0
 
LVL 84

Accepted Solution

by:
ozo earned 500 total points
ID: 40550193
#!/usr/bin/perl -lna
BEGIN{$"="; "}
$d=join" ",splice @F,0,4;
if( $d ne $p && @d ){
    print "$d @d";
    @d=();
}
$p=$d;
push @d,(join" ",@F)=~s/:\s?/=/r;
END{print "$d @d"}
0
Major Serverless Shift

Comparison of major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform

 

Author Comment

by:tobe1424
ID: 40551372
Thanks so much ozo. I will test this.

cheers
0
 

Author Comment

by:tobe1424
ID: 40560065
newb q

is this a regular expression in perl ?
0
 

Author Comment

by:tobe1424
ID: 40574008
would i need to run this perl script at the indexer or on an intermediate server ?

from the indexer the windows event logs are convert/forwarded to a 3rd party appliance ( a log collector/aggregator) which the logs show with a date/time stamp on ever single line break. Even though we assume we are correctly configured to forward/convert the logs from wins to a syslog format.

t
0

Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It is a general practice to get rid of old user profiles on a computer  in a LAN environment. As I have been working with a company in a LAN environment where users move from one place to some other place at times. This will make many user profil…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question