<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Answered out of band because the
details are messy.<br>
If there is sufficient interest I can clean it up and post it to
the list.<br>
<br>
Evan.<br>
<br>
On 11/15/2017 04:26 AM, Scot wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAOxbc8H0MZqNCQ5P3XJLymJBzZciRgzMfK748xyoVu+A=zr5=g@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">Thanks Evan,
<div>Didn't see much in term of cisco documentation of the
format. Is that 1st number in the message header unique to
each message and do you share patterns ?</div>
<div><br>
</div>
<div>Scot</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Nov 14, 2017 at 8:36 PM, Evan
Rempel <span dir="ltr"><<a href="mailto:erempel@uvic.ca"
target="_blank" moz-do-not-send="true">erempel@uvic.ca</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">At our
side we used a patterndb to unwrap the ACS logs into single
long line messages. These long lines seem to be wrapped at
the source (Cisco device) before sending to the syslog
server.<br>
<br>
Evan.
<div>
<div class="h5"><br>
<br>
On 11/14/2017 02:03 PM, Scot wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
Has anyone worked with ACS logs and solved the
message header limit ?<br>
We can get syslog working but as expected the message
gets truncated.<br>
<br>
Local logs on the ACS have the entire payload.<br>
<br>
Thinking there may be a way to script a log fetch or
something.<br>
<br>
Thanks</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>