Uploaded image for project: 'OpenNMS Horizon'
  1. OpenNMS Horizon
  2. HZN-1504

Enhance RadixTreeSyslogParser to ignore specific characters

    XMLWordPrintable

    Details

    • Type: Enhancement
    • Status: Resolved (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 24.0.0
    • Component/s: None
    • Labels:
    • Sprint:
      Horizon - April 3rd 2019

      Description

      In the field, we've observed messages of the form:

      <187>2765: .Jan  7 12:36:39: %LINK-3-UPDOWN: Interface GigabitEthernet0, changed state to up
      

      and of the form:

      <189>338: *Jan 17 17:05:36.608: %SYS-5-CONFIG_I: Configured from console by console
      

      These message parse successfully if we remove the leading character before the month.

      We should enhance the Grok pattern support so that was can parse these successfully. Maybe using something like:

      <%{INT:facilityPriority}>%{INT:parmSequenceNum}: %{CHAR:ignore}%{STRING:month} %{INT:day} %{INT:hour}:%{INT:minute}:%{INT:second}.%{INT:secondFraction}: %{STRING:message}
      

        Attachments

          Activity

            People

            • Assignee:
              cpape Christian Pape
              Reporter:
              j-white Jesse White
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: