1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

  
<Extension json>
    Module    xm_json
</Extension>

define  type1 /(?x)^(?<Message>.*)\$\$\<\
              (?<Component>.*)\>\<\
              (?<EventTime>.*).\d{3}-\d{2}\>\<thread=\
              (?<Thread>\d+)/s

define  type2 /(?x)^\<\!\[LOG\[(?<Message>.*)\]LOG\]\!\>\<time=\"\
              (?<Time>.*).\d{3}-\d{2}\"\s+date=\"\
              (?<Date>.*)\"\s+component=\"\
              (?<Component>.*)\"\s+context=\"\
              (?<Context>.*)\"\s+type=\"\
              (?<Type>.*)\"\s+thread=\"\
              (?<Thread>.*)\"\s+file=\"\
              (?<File>.*)\"\>/s


<Input in>
    Module    im_file
    File      'C:\WINDOWS\SysWOW64\CCM\Logs\*'
    File      'C:\WINDOWS\System32\CCM\Logs\*'
    File      'C:\Program Files\Microsoft Configuration Manager\Logs\*'
    File      'C:\Program Files\SMS_CCM\Logs\*'
    <Exec>
        if file_name() =~ /^.*\\(.*)$/ $Filename = $1;
        if $raw_event =~ %type1%;
        else
        if $raw_event =~ %type2%
            {
             $EventTime = $Date + " " + $Time;
             delete($Date);
             delete($Time);
            }
        else
        $Message = $raw_event;
        $EventTime = strptime($EventTime, '%m-%d-%Y %H:%M:%S');
        to_json();
    </Exec>
</Input>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

  
<Extension _json>
    Module              xm_json
</Extension>

<Input sccm_alerts>
    Module              im_odbc
    ConnectionString    DSN=SMS SQL;database=CM_CND;uid=user;pwd=password;
    SQL                 SELECT ID,TypeID,TypeInstanceID,Name,FeatureArea, \
                        ObjectWmiClass,Severity FROM V_SMS_Alert
</Input>

<Input sccm_audit>
    Module              im_odbc
    ConnectionString    DSN=SMS SQL;database=CM_CND;uid=user;pwd=password;
    SQL                 SELECT * FROM v_StatMsgWithInsStrings
</Input>

<Output outfile>
    Module              om_file
    File                'C:\logs\out.log'
    Exec                to_json();
</Output>

<Route sccm>
    Path                sccm_alerts, sccm_audit => outfile
</Route>