<div dir="ltr"><span style="font-size:12.8px">Hello,</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Checking your configuration I see that you are using multi-line mode for a network source driver.</div><div style="font-size:12.8px">Unfortunately, currently this is not supported, only the file() and pipe() source drivers support multi-line messages.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I have checked the documentation and found that although it is mentioned which source drivers support multi-line mode (under flags option "no-multi-line"),</div><div style="font-size:12.8px">the multi-line-* options are included in the network source driver options page.</div><div style="font-size:12.8px">This is a documentation bug, which will be fixed soon. Sorry for the inconveniences.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Best Regards,</div><div style="font-size:12.8px">Gabor</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 10, 2017 at 8:15 PM, Smith, Paul (Sr. Admin-InfoSec) <span dir="ltr"><<a href="mailto:Paul.C.Smith@snapon.com" target="_blank">Paul.C.Smith@snapon.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-5164686722596208454WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m having problems getting Windows events on a single line on syslog-ng OSE. I’ve scoured the interwebs and not found what I need to get this exact. I am guessing this is not an uncommon problem but I can’t seem to find quite what I need.
I am guessing I am just missing some simple thing here.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Here are my details.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Using syslog-ng OSE 3.9.1<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Have syslog-ng Windows Agent 6.0.6 running on Windows 2012 server<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Have a tcp source and that writes direct to the log file. Works fine with no options set.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Getting multiple lines per event.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ve added what I think are the correct settings for multi-line, it does not work. I don’t think it is the regex syntax, but something else?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">___________<u></u><u></u></p>
<p class="MsoNormal">Syslog.ng.conf<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">source s_nettcp_win { network(ip(x.x.x.x) port(601) transport("tcp")<u></u><u></u></p>
<p class="MsoNormal"> multi-line-mode(regexp)<u></u><u></u></p>
<p class="MsoNormal"> multi-line-prefix("^[0-9]{3,5}<wbr>\s<[0-9]{2,3}>1\s([0-9]{4})-(<wbr>0[1-9]|1[0-2])-(0[1-9]|[1-2][<wbr>0-9]|3[0-1])T([0-9]{2}:[0-9]{<wbr>2}:[0-9]{2}-[0-9]{2}:[0-9]{2})<wbr>")<u></u><u></u></p>
<p class="MsoNormal"> flags(no-parse)); };<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">___________<u></u><u></u></p>
<p class="MsoNormal">Here is the error when trying to start syslog-ng or run syslog-ng –s:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER, expecting KW_NORMALIZE_HOSTNAMES or KW_USE_DNS or KW_USE_FQDN or KW_DNS_CACHE in /etc/syslog-ng/syslog-ng.conf at line 38, column 76:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">source s_nettcp_win { network(ip(x.x.x.x) port(601) transport("tcp") multi-line-mode(regexp) multi-line-prefix("^[0-9]{3,5}<wbr>\s<[0-9]{2,3}>1\s([0-9]{4})-(<wbr>0[1-9]|1[0-2])-(0[1-9]|[1-2][<wbr>0-9]|3[0-1])T([0-9]{2}:[0-9]{<wbr>2}:[0-9]{2}-[0-9]{2}:[0-9]{2})<wbr>")
flags(no-parse)); };<u></u><u></u></p>
<p class="MsoNormal"> <wbr> <wbr> ^^^^^^^^^^^^^^^<u></u><u></u></p>
<p class="MsoNormal">___________<u></u><u></u></p>
<p class="MsoNormal">Sample of the event log part I am matching regex on:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Jul 10 12:11:19 x.x.x.x 912 <133>1 2017-07-10T12:11:18-05:00 computername Microsoft_Windows_security_<wbr>auditing. 6260 - [win@18372.4 EVENT_CATEGORY="Logoff" EVENT_FACILITY="16" EVENT_ID="4634" EVENT_LEVEL="0" EVENT_NAME="Security" EVENT_REC_NUM="573516592"
EVENT_SID="N/A" EVENT_SOURCE="Microsoft Windows security auditing." EVENT_TASK="Logoff" EVENT_TYPE="Success Audit" EVENT_USERNAME="domain\\<wbr>userid"][meta sequenceId="10817278" sysUpTime="-198876"] domain\userid: Security Microsoft Windows security auditing.:
[Success Audit] An account was logged off.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>