We use cookies to ensure that we give you the best experience on our website.  Visit our Privacy Policy to learn more. If you continue to use this site, we will assume that you are okay with it.

Your choices regarding cookies on this site.
Your preferences have been updated.
In order for the changes to take effect completely please clear your browser cookies and cache. Then reload the page.

Werk #0301: Handling messages of special syslog format correctly

ComponentEvent Console
TitleHandling messages of special syslog format correctly
Date2013-12-06 10:02:22
Checkmk EditionCheckmk Raw Edition (CRE)
Checkmk Version1.2.5i1
LevelTrivial Change
ClassNew Feature
CompatibilityCompatible - no manual interaction needed

The syslog RFCs allow different formats of syslog messages. The message parsing code in the Event Console does support several formats and should be able to deal with all formats allowed by the specifications. However, one format was not supported in past versions. Those messages were simply dropped and only seen in the logs of the Event Console, when rule execution debugging is enabled.

These log entries look as follows:

<5>SYSTEM_INFO: [WLAN-1] Performing Background Scan : channel 12, active, 28 TU

The specific part here is the missing date/time and missing hostname information, which is sent by most syslog clients. The parser has been changed to be able to parse this format. The Event Console adds the current date/time to the event and the IP address of the sending client as host information.