Hi All,<div>I have a user receiving messages from Snare but, for some reason, syslog-ng doesn&#39;t appear to be converting the TAB characters properly.</div><div><br></div><div>Snare sends messages as:</div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">HostName&lt;TAB&gt;MSWinEventLog&lt;TAB&gt;Criticality&lt;TAB&gt;EventLogSource&lt;TAB&gt;SnareCounter&lt;TAB&gt;SubmitTime&lt;TAB&gt;EventID&lt;TAB&gt;SourceName&lt;TAB&gt;UserName&lt;TAB&gt;SIDType&lt;TAB&gt;EventLogType&lt;TAB&gt;ComputerName&lt;TAB&gt;CategoryString&lt;TAB&gt;DataString&lt;TAB&gt;ExpandedString&lt;TAB&gt;MD5 checksum (optional)</span>
</div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"><br></span></div><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">I have verified using a sniffer on the syslog-ng server that the message format is coming in correctly with the TABs, but somehow the messages are leaving syslog-ng as:</span></div>
<div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"><br></span></div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">...snip (full message clipped for brevity)</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012592Security</font></span>SYSTEMUserSuccess Audit</div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">...snip</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif"><br></font></span></div><div><span style="background-color:rgb(255,255,255)"><font face="sans-serif"><span style="line-height:19px">In the example above, it should be:</span></font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Tue Jun 05 11:09:27 2012\011592\011Security\011</font></span>SYSTEM\011User\011Success Audit</div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif"><br>
</font></span></div><div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">I&#39;ve checked his syslog-ng.conf file and it is the normal one that comes with </font></span>
<span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:12px;line-height:15px;text-align:left;background-color:rgb(255,255,255)">Ubuntu 12.4 LTS</span><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">.</font></span></div>
<div><span style="background-color:rgb(255,255,255);line-height:19px"><font face="sans-serif">Any idea what might be causing this?</font></span></div><div><br clear="all">______________________________________________________________ <br>
<br>Clayton Dukes<br>______________________________________________________________<br>
</div>