Anyone have any idea?<br clear="all">______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________<br>
<br><br><div class="gmail_quote">On Wed, Jun 6, 2012 at 11:47 AM, Clayton Dukes <span dir="ltr"><<a href="mailto:cdukes@gmail.com" target="_blank">cdukes@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi All,<div>I have a user receiving messages from Snare but, for some reason, syslog-ng doesn't appear to be converting the TAB characters properly.</div><div><br></div><div>Snare sends messages as:</div><div><span style="line-height:19px;font-size:13px;font-family:sans-serif">HostName<TAB>MSWinEventLog<TAB>Criticality<TAB>EventLogSource<TAB>SnareCounter<TAB>SubmitTime<TAB>EventID<TAB>SourceName<TAB>UserName<TAB>SIDType<TAB>EventLogType<TAB>ComputerName<TAB>CategoryString<TAB>DataString<TAB>ExpandedString<TAB>MD5 checksum (optional)</span>
</div><div><span style="line-height:19px;font-size:13px;font-family:sans-serif"><br></span></div><div><span style="line-height:19px;font-size:13px;font-family:sans-serif">I have verified using a sniffer on the syslog-ng server that the message format is coming in correctly with the TABs, but somehow the messages are leaving syslog-ng as:</span></div>
<div><span style="line-height:19px;font-size:13px;font-family:sans-serif"><br></span></div><div><span style="line-height:19px"><font face="sans-serif">...snip (full message clipped for brevity)</font></span></div>
<div><span style="line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012592Security</font></span>SYSTEMUserSuccess Audit</div><div><span style="line-height:19px"><font face="sans-serif">...snip</font></span></div>
<div><span style="line-height:19px"><font face="sans-serif"><br></font></span></div><div><span style><font face="sans-serif"><span style="line-height:19px">In the example above, it should be:</span></font></span></div>
<div><span style="line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012\011592\011Security\011</font></span>SYSTEM\011User\011Success Audit</div><div><span style="line-height:19px"><font face="sans-serif"><br>
</font></span></div><div><span style="line-height:19px"><font face="sans-serif">I've checked his syslog-ng.conf file and it is the normal one that comes with </font></span>
<span style="line-height:15px;text-align:left;color:rgb(51,51,51);font-size:12px;font-family:Arial,Helvetica,sans-serif">Ubuntu 12.4 LTS</span><span style="line-height:19px"><font face="sans-serif">.</font></span></div>
<div><span style="line-height:19px"><font face="sans-serif">Any idea what might be causing this?</font></span></div><span class="HOEnZb"><font color="#888888"><div><br clear="all">______________________________________________________________ <br>
<br>Clayton Dukes<br>______________________________________________________________<br>
</div>
</font></span></blockquote></div><br>