Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The logs that reach our Kiwi syslog server from windows machines appear like below:

EventLog 1 System 483 Thu Nov 18 04:51:53 2010 7036 Service Control Manager Unknown User N/A Information host.domain.com None 0000: 57 00 69 00 6e 00 48 00 .... 0008: 74 00 74 00 70 00 41 00 .... 0010: 75 00 74 00 6f 00 50 00 .... 0018: 72 00 6f 00 78 00 79 00 .... 0020: 53 00 76 00 63 00 2f 00 .... 0028: 34 00 00 00 6e 69 6e 67 ... The WinHTTP Web Proxy Auto-Discovery Service service entered the running state. 125

Is there a way to remove the extra info (hex, dots etc,) and have just the readable portion of the messages displayed? We are using Snare for the clients.

Thank you.

share|improve this question

1 Answer 1

Syslog-ng (http://www.balabit.com/network-security/syslog-ng/) has fairly powerful rewriting capabilities. You can find a description of the rewriting syntax here:

It's an excelllent product.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.