0

I have a windows server 2012 r2 machine with sophos. Each day there is a scan from sophos and the information is appended to the log "sav.txt".

Output example (Some info changed):

    20150710 205446 Using detection data version 5.16 (detection engine 3.58.3). This version can detect 9405871 items.
20150710 205446 User (NT AUTHORITY\LOCAL SERVICE) has started on-access scanning for this machine.
20150711 020000 Scan 'Sophos Management Server' started.
20150711 023317 Scan 'Sophos Management Server' completed.
20150711 023317 Summary of results for scan 'Sophos Management Server':
  Items scanned: 166433
  Errors: 0
  Items quarantined: 0
  Items dealt with: 0

Using nxlog, I want to be able to parse the sav.txt file for the information I have show in the output example for only the current day and send off that info to a syslog server.

The only problem is as the sav.txt file will get larger and larger as time goes by, we want nxlog to only send the info out of the text file for that dates day.

Only July 1, only July first messages will be sent to our syslog server, on July 2nd.. the same, etc.

I don't know if it matters, but we are using Kiwi Syslog for the server. Kiwi has a free utility for windows, but it does not parse text files and send only the info we need. Kiwi seems to only pull from the event log, but can recieve whatever.

1 Answer 1

1

Probably there are different ways but the following will do that:

Exec if not (($raw_event =~ /^(\d{4})(\d{2})(\d{2}) /) and \
             (substr(string(now()), 0, 10) == $1 + '-' + $2 + '-' + $3)) drop();
  • Note that NXLog will only send the most recent data and normally does not resend the whole file unless the log source creates a new one and copies the content.
  • You will probably want to use xm_multiline for the events spanning more than one line.
  • Wouldn't be better to set up log rotation on sav.txt so that old entries are rotated away?
1
  • Thank you. We plan to try this today and I will respond with our results! Thanks so much!
    – Patrick
    Jul 17, 2015 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .