<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7232.62">
<TITLE>Syslog-ng Event Parsing Question</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I am running syslog-ng version 1.6.4 in place of syslogd on Solaris 8.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Getting the following results when receiving syslog events with an embedded dash '-':</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Actual Event</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Shows up in Syslog log as</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Aug 10 04:15:22 <Device Name A>.<Domain Name> 4845: -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2 FACE="Courier New">Actual Event</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 -Process= \"DLSw msg proc\", ipl= 0, pid= 62 -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Shows up in Syslog log as</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">May 6 10:04:45 <Device Name B>.<Domain Name> 41: -Process= \"DLSw msg proc\", ipl= 0, pid= 62</FONT>
<BR><FONT SIZE=2 FACE="Courier New">May 6 10:04:45 <Device Name B>.<Domain Name> 42: -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0</FONT></P>
<P> <FONT SIZE=2 FACE="Courier New">Anyone have an answer as to why it is splitting up the Syslog events this way, and if so, how do you correct it?</FONT></P>
<P> <FONT SIZE=2 FACE="Courier New">Also, is there a search function for the archives? Visually looking through month after month put me to sleep pretty quickly!</FONT></P>
<P> <FONT SIZE=2 FACE="Courier New">Thanks</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">Bill</FONT>
</P>
<BR>
<BR>
</BODY>
</HTML>