Home / server / Questions / 203648
In Process
Bourne
Asked: 2010-11-19 13:48:01 +0800 CST

How can I clean up the kiwi syslogs by not displaying hex info?

  • 772

The logs that reach our Kiwi syslog server from windows machines appear like below:

EventLog 1 System 483 Thu Nov 18 04:51:53 2010 7036 Service Control Manager Unknown User N/A Information host.domain.com None 0000: 57 00 69 00 6e 00 48 00 .... 0008: 74 00 74 00 70 00 41 00 .... 0010: 75 00 74 00 6f 00 50 00 .... 0018: 72 00 6f 00 78 00 79 00 .... 0020: 53 00 76 00 63 00 2f 00 .... 0028: 34 00 00 00 6e 69 6e 67 ... The WinHTTP Web Proxy Auto-Discovery Service service entered the running state. 125

Is there a way to remove the extra info (hex, dots etc,) and have just the readable portion of the messages displayed? We are using Snare for the clients.

Thank you.

syslog

1 Answers

  1. Syslog-ng (http://www.balabit.com/network-security/syslog-ng/) has fairly powerful rewriting capabilities. You can find a description of the rewriting syntax here:

    It's an excelllent product.

    • 1