XMA: UDP message to syslog server omits space

XMA: UDP message to syslog server omits space

Moving the last word ?XYGATEMA? would restore the space and return the expected value XYGATEMA @0.  The following is a workaround in Version 1.80 to eliminated the space after the IPALERT_PREFIX:
 
IPALERT_PREFIX <130>
ALERTSTRING XYGATEMA
 
Would return the EXPECTED value XYGATEMA @0

If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.

    • Related Articles

    • XMA: How to format Timestamp in SYSLOG Message to meet RFC 5424 standard

      Solution: The ALERSTRING in the FILTERS file can be modified. Substrings can be used to split the timestamp and insert characters and the use of curly brackets instead of parenthesis will result in the space between strings being removed. The ...

    • Is there an RFC standard format for XMA syslog messages?

      XYGATEMA does not follow a RFC standard format for delivering syslog messages. XMA builds the messages based on the ALERTSTRING configuration for each filter that is added to the FILTERS. The FILTERS file is located in the XYGATEMA installation ...

    • XMA: How to Change IP Address of the syslog server using SYSLOGQ

      To change the SIEM IP address use the following to change the IP address in the records stuck in the SySLOGQ table , and update the FILTERS file for future records. TACL> VOLUME $<VOLUME>.<XYGATEMA Installation Subvolume> TACL> RUN XMA INSTALL TACL> ...

    • XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

      To send Syslog messages to 2 SIEM, it's required to have two ACTION having each one set with one of the SIEM IP Address. ACTIONCOLL_BEGIN ACTION_BEGIN ACTIONTYPE IPALERT ! SYSLOGQ .... IPALERT_ADDRESS <IP Address-A> .... ACTION_END ACTION_BEGIN ...

    • XMA: How to uninstall SLSENDER.

      As the SLSENDER is configured and added to the XMA pathway when the customer follows the installation process in the XMA manual. The following procedure can be used to manually stop the SLSENDER , remove any records that have been generated, and stop ...