XMA: How to format Timestamp in SYSLOG Message to meet RFC 5424 standard

XMA: How to format Timestamp in SYSLOG Message to meet RFC 5424 standard

Solution:

The ALERSTRING in the FILTERS file can be modified. Substrings can be used to split the timestamp and insert characters and the use of curly brackets instead of parenthesis will result in the space between strings being removed.

The following structure can be used to format SYSLOG message timestamps to meet the RFC 5424 format.

    ALERTSTRING |{substr(audit.recordlct,1,10)}|T
    ALERTSTRING |{substr(audit.recordlct,12,8)}|Z
    
Appears at the SIEM as: 2022-12-13T09:23:32Z


If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.

    • Related Articles

    • Is there an RFC standard format for XMA syslog messages?

      XYGATEMA does not follow a RFC standard format for delivering syslog messages. XMA builds the messages based on the ALERTSTRING configuration for each filter that is added to the FILTERS. The FILTERS file is located in the XYGATEMA installation ...

    • XMA: What is the datetime format in REPSAMP?

      REPSAMP is the report sample file in the XMA installation subvolume. Datetime format in the REPSAMP is MM-DD :HH . Replace 99-99:99 with the time frame you require. For example, the query below will retrieve records between 8.00pm 2018/05/25 and ...

    • XMA: UDP message to syslog server omits space

      Moving the last word ?XYGATEMA? would restore the space and return the expected value XYGATEMA @0. The following is a workaround in Version 1.80 to eliminated the space after the IPALERT_PREFIX: IPALERT_PREFIX <130> ALERTSTRING XYGATEMA Would return ...

    • XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

      If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...

    • XMA: Critical Msg:Syslog Sender SLSENDER Unable to send messages to host

      Wait for the HKEEPER to delete the records based on the maximum age of not sent messages to be retained or use the following SQL queries to identify and delete or change the relevant records. Show ?stuck? records and allow them to be deleted or ...