Using NxLog with "EXEC to_syslog_snare();" to output Windows Events. What parser should be used by the Decoder? I thought maybe winevent_snare but maybe it is rhlinux.
Which parser should be used... or should I only care the windows event logs are parsed correctly?
Comments (1)
Hi,
The decoders used in Netwitness. The job of a decoder is to select a parser to parse log files.
The LogDeconder shows Service Type as unknown but I was expecting to see winevent_snare.
My config using the Exec $Message =~ s/(\t|\R)/ /g; to_syslog_snare(); to send windows log data to the collector/decoder.
The problem is the decoder is using unknown or rxlinux as service type not winevent_snare to parse my windows log files. I was looking for the decoder to use winevent_snare but it is not.
Thanks for you assistance,
Jim