Hi All,<div>I have a user receiving messages from Snare but, for some reason, syslog-ng doesn't appear to be converting the TAB characters properly.</div><div><br></div><div>Snare sends messages as:</div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">HostName<TAB>MSWinEventLog<TAB>Criticality<TAB>EventLogSource<TAB>SnareCounter<TAB>SubmitTime<TAB>EventID<TAB>SourceName<TAB>UserName<TAB>SIDType<TAB>EventLogType<TAB>ComputerName<TAB>CategoryString<TAB>DataString<TAB>ExpandedString<TAB>MD5 checksum (optional)</span>
</div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"><br></span></div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">I have verified using a sniffer on the syslog-ng server that the message format is coming in correctly with the TABs, but somehow the messages are leaving syslog-ng as:</span></div>
<div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"><br></span></div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">...snip (full message clipped for brevity)</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012592Security</font></span>SYSTEMUserSuccess Audit</div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">...snip</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif"><br></font></span></div><div><span style="background-color:rgb(255,255,255)"><font face="sans-serif"><span style="line-height:19px">In the example above, it should be:</span></font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012\011592\011Security\011</font></span>SYSTEM\011User\011Success Audit</div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif"><br>
</font></span></div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">I've checked his syslog-ng.conf file and it is the normal one that comes with </font></span>
<span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:12px;line-height:15px;text-align:left;background-color:rgb(255,255,255)">Ubuntu 12.4 LTS</span><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">.</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Any idea what might be causing this?</font></span></div><div><br clear="all">______________________________________________________________ <br>
<br>Clayton Dukes<br>______________________________________________________________<br>
</div>