Log Parser is not working

[mistercinux]

Hello all, 

I enabled the Syslog server on a management server, and I want to see those logs on smartview tracker, but they are not really usable because no information is showned in the line, and I didn't found any column which simply shows the syslog message, and I can't find any documentation about this.

Is that possible to simply add a column with the syslog message ?

[Dan_Zada]

Hi,

In case you did not configure any log parser, you should see the entire log message in a field called "default"_device_message".

Are you using SmartConsole? SmartView?

[mistercinux]

Hello Dan_Zada,

Thank you for replying!

I can't find this column in the profile edititor :

I also tried to create a custom parser with the string into the "default_device_message" in the log details as following :

And it matches all logs using Eventia's simulation, but they are not tagged with the right product and so. When configuring, a parser with eventia, should the "Default Device Message" be used for parser creation ? 

(The parser was installed on the smartLog server, and cpstop/cpstart was done)

Best regards.

[mistercinux]

Hi,
I'm using SmartConsole, but I also tried to make it work with smartView.

[Dan_Zada]

Hi,

I'm not sure I understand the issue, so I will try to clarify few things:

1. In case no parser was applied, the entire syslog message will be parsed into "default_device_message" and the product/blade will be called "Syslog"

2. Using the Eventia Log Parser, you can configure your parser by copying a log example and map the fields to Check Point fields or to your own fields (notice that in case you are using your own fields, they will not be indexed). You can also configure what the product name will be called. 

3. Once you apply those changes (using the Eventia scripts from the SK), the log server will parse the data and the fields will be populated

Thanks!

Dan.

[mistercinux]

Hello Dan, and thank you for your answere.

My parser don't work and the syslog messages are still showed in the "Default Device Message" field, Is there a way to show the column "Default Device Message" in smarv view (without having to open each log line), in order to have a real log view ? 

I can't find a way to show this column.

Best regards,