LogFile, Perl EventLog for Windows, and SNMP Adapter parsers

The LogFile Adapter, Perl EventLog for Windows Adapter, and SNMP Adapters include dedicated internal parsing functions.

Events in a log file are determined either by a record separator or by a Perl regular expression.

The most common event separator is newline ( \n ). The parameter LogRecordSeparator contains the record separator of the events. LogRecordSeparator recognizes Perl escape characters, such as \n, and generally can contain several characters or even a regular expression. For example, setting LogRecordSeparator="\n\n" results in events being delimited by two consecutive new line characters which results in a single empty line. By default, setting LogRecordSeparator = "\n" creates events that are line-based. In other cases, the parsing will be multilined.

The input variable $complete is set to the string between the two consecutive LogRecordSeparator entries.

According to the value of the parameter LogRegExpr, the following instances are considered:

• LogRegExpr is empty. $complete is split into substrings, delimited by the LogFieldSeparator variable. These substrings are stored in $varlog<N> variables ( N>=0 ). For example, if
  $complete contains "a;b;c;d", and $LogFieldSeparator contains ";"
  then
  $varlog0="a" $varlog1="b" ...
• LogRegExpr is not empty. The regular expression LogRegExpr is applied to $complete. Subpatterns of $complete are stored in $varlog<N> variables ( N>=1 ). For example, if
  $complete contains "12345 abcde", and $logRegExpr contains "(\d+)\s*(\w+)"
  then
  $varlog1=12345 $varlog2="abcde"
• LogRecordSeparator is empty and LogRegExpr is not empty. In this case, the regular expression contained in LogRegExpr will be applied to the log file from the point at which the previous successful matching stopped. The input variable $complete will be set to the whole matching of the regular expression. LogVarPrefix contains the names of variables containing subpatterns. By default,
  LogVarPrefix="varlog"
  If both variables are empty, the behavior of the adapter is not determined.