Privacy Policy

Guest
  • Guest
  • Guest Topic Starter
2003-09-11T09:13:16Z
Date parsed: 9/11/2003 9:13:16 AM

Date: Thu, 11 Sep 2003 14:13:16 -0400

I have this issue and I don't know what the best solution is. I hope I can

explain my question clearly.

I currently syslog all of device syslog messages into an ODBC (SQL2K) DB

(created with the sql script that came with the product) and this works

fine.

All of the individual syslog message components are correctly mapped to its

corresponding SQL Table column. In the MessageText column, it contains the

important syslog message content that I want to query thru SQL. The format

of content in the MessageText column is a string consists of space separated

values. Example:

Complete Syslog message:

9/10/2003,12:02:23 AM,172.29.160.10,XYZ.bbb.org,LOCAL7,NOTICE,3495000

09/10/2003 00:02:22.950 SEV=4 AUTH/28 RPT=43824 32.101.165.122 User [ABC]

Group [CNN] disconnected: Duration: 0:01:14 Bytes xmt: 23632 Bytes rcv:

28400 Reason: User Requested

MessageText column of the syslog message above. In the column it contains

the following space separated values:

3495000 09/10/2003 00:02:22.950 SEV=4 AUTH/28 RPT=43824 32.101.165.122 User

[ABC] Group [CNN] disconnected: Duration: 0:01:14 Bytes xmt: 23632 Bytes

rcv: 28400 Reason: User Requested

Currently this whole string is in the MessageText column which makes it

difficult to perform SQL query against the values contained within the

string.

So what I would like to do is be able to map the individual space separate

value in this string in the MessageText column to its own colum either in

the same table or in another table. Please note, I can't use the custom

mapping option in the log to ODBC feature since that maps a syslog column to

a SQL colum which is working for me. What I need to do is then take the

content in one of the syslog column (MessageText), further separating them

and map each to its own SQL column which I can't do with ODBC custom mapping

feature. I want to do this in SL4NT before it gets into the SQL DB.

Can you recommend a solution for this situation using SL4NT?

One thing I was thinking of was using the Custom Evaluator. One thoght was

to use the Custom Evaluator and somehow have it read the content of the

MessageText column as it comes in and have it directly write each space

separated value to its own column in the SQL table. Is this possible?

Another possibility was using the Custom Evaluator to reformat the incoming

syslog messages so that each of the MessageText space separated values

becomes a comma separated value and I can then maybe use the Custom Mapping

feature in Log to ODBC to map each of these "new" comma separate values into

the SQL DB. I don't know if this is possible.

Do you have any other ideas (simplier?) for SL4NT that I can use to

accomplish my goal?

Can I use the "Run a program" option to parse the incoming syslog message,

ie similar to a "pipe" command?

This is a long message but I am stuck..

Thanks,

John

Guest
  • Guest
  • Guest Topic Starter
2003-09-11T23:24:22Z
Date parsed: 9/11/2003 11:24:22 PM

Date: Thu, 11 Sep 2003 22:24:22 +0200

"John Smith" <apu000a@hotmail.com> wrote in message

news:qx5ChBJeDHA.1920@is1.netal.com...

<snip>

> So what I would like to do is be able to map the individual space

separate

> value in this string in the MessageText column to its own colum either

in

> the same table or in another table.

<snip>

> Can I use the "Run a program" option to parse the incoming syslog

message,

> ie similar to a "pipe" command?

>

> This is a long message but I am stuck..

>

> Thanks,

> John

>

You should definately be able to get the wanted results via the run a

program option.

I am doing something similar, on some specific Syslog messages i want

to receive a SNMP-trap in my management system. I build a small script

(using Franz' scripting tool) which does first some string-manipulation,

and than generates an SNMP-trap.

In stead of sending a trap, you should be able to build a new syslog

message, and catch that in SL4NT to send it to the ODBC.... The original

(unmodified) syslog message is than ofcourse not send to the ODBC...

Let us know if you succeeded....

Martin

Guest
  • Guest
  • Guest Topic Starter
2003-09-12T07:11:37Z
Date parsed: 9/12/2003 7:11:37 AM

Date: Fri, 12 Sep 2003 12:11:37 -0400

Thanks... What I might end up doing is to use this option, call a java

applet that pases the syslog string and write the parsed and needed space

separated value in the MessageText to its corresponding column in the SQL DB

thru JDBC... This might be simplier than using the Custom Evaluator or the

Custom Action Handlers since our expertise is more in Java than C++ or VB.

The only concern I have is the overhead and efficiency. It looks like using

the Custom Action/Evaluator Handlers might be more efficient since it is

launched at the SL4NT service startup (if I read it right) and compared that

with the Run Program option which seems to launch then terminate the called

application each time the rule is triggered...

John

"Martin" <martin@notfor.spam.local> wrote in message

news:L7eUwKKeDHA.1924@is1.netal.com...

>

> "John Smith" <apu000a@hotmail.com> wrote in message

> news:qx5ChBJeDHA.1920@is1.netal.com...

> <snip>

> > So what I would like to do is be able to map the individual space

> separate

> > value in this string in the MessageText column to its own colum either

> in

> > the same table or in another table.

>

> <snip>

>

> > Can I use the "Run a program" option to parse the incoming syslog

> message,

> > ie similar to a "pipe" command?

> >

> > This is a long message but I am stuck..

> >

> > Thanks,

> > John

> >

>

> You should definately be able to get the wanted results via the run a

> program option.

> I am doing something similar, on some specific Syslog messages i want

> to receive a SNMP-trap in my management system. I build a small script

> (using Franz' scripting tool) which does first some string-manipulation,

> and than generates an SNMP-trap.

> In stead of sending a trap, you should be able to build a new syslog

> message, and catch that in SL4NT to send it to the ODBC.... The original

> (unmodified) syslog message is than ofcourse not send to the ODBC...

>

> Let us know if you succeeded....

>

> Martin

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-14T17:14:13Z
Date parsed: 9/14/2003 5:14:13 PM

Date: Sun, 14 Sep 2003 16:14:13 +0200

> One thing I was thinking of was using the Custom Evaluator. One thoght was

> to use the Custom Evaluator and somehow have it read the content of the

> MessageText column as it comes in and have it directly write each space

> separated value to its own column in the SQL table. Is this possible?

Yes, that's the way to go:

Implement a custom evaluator object that takes the message text, extracts

the data to be separated and stores them in the (up to 16) available custom

fields. Then configure your "Log to ODBC" action to map the used custom

fields to your table columns.

> Another possibility was using the Custom Evaluator to reformat the

incoming

> syslog messages so that each of the MessageText space separated values

> becomes a comma separated value and I can then maybe use the Custom

Mapping

> feature in Log to ODBC to map each of these "new" comma separate values

into

> the SQL DB. I don't know if this is possible.

This won't work.

> Can I use the "Run a program" option to parse the incoming syslog message,

> ie similar to a "pipe" command?

You could use a "Run a program" action to parse the message text into the

desired parts but there are two big problems with this approach:

1. Very slow

2. The program called must then take care of logging the data to the DB.

I can only recommend to implement a custom evaluator object. This approach

is perfectly suited for your requirements (verfy fast & minimal resource

usage).

Should you need help in implementing such a custom evaluator object, please

contact me.

Franz

Guest
  • Guest
  • Guest Topic Starter
2003-09-19T06:06:50Z
Date parsed: 9/19/2003 6:06:50 AM

Date: Fri, 19 Sep 2003 11:06:50 -0400

Franz,

Thanks for the responses. Right now we are either going with Run Program

(program would be Java applet using JDBC) OR the Custom Evaluator. I am very

rusty in my C++ and VB so I am asking one of the developers in my company to

help me. I need to speak with him on which approach he is comfortable with

(he knows both java and C++ but java better).

I guess I should take a look at the sample source and see if it is

sufficiently complete for me or my developer to modify to meet our needs

without extensive work.

If we decide to go with the custom evaluator and run into a problem, we will

definitely contact you for help...

Thanks,

John

"Franz Krainer" <franzk@netal.com> wrote in message

news:u7ON5pseDHA.3388@is1.netal.com...

> > One thing I was thinking of was using the Custom Evaluator. One thoght

was

> > to use the Custom Evaluator and somehow have it read the content of the

> > MessageText column as it comes in and have it directly write each space

> > separated value to its own column in the SQL table. Is this possible?

>

> Yes, that's the way to go:

>

> Implement a custom evaluator object that takes the message text, extracts

> the data to be separated and stores them in the (up to 16) available

custom

> fields. Then configure your "Log to ODBC" action to map the used custom

> fields to your table columns.

>

>

> > Another possibility was using the Custom Evaluator to reformat the

> incoming

> > syslog messages so that each of the MessageText space separated values

> > becomes a comma separated value and I can then maybe use the Custom

> Mapping

> > feature in Log to ODBC to map each of these "new" comma separate values

> into

> > the SQL DB. I don't know if this is possible.

>

> This won't work.

>

> > Can I use the "Run a program" option to parse the incoming syslog

message,

> > ie similar to a "pipe" command?

>

> You could use a "Run a program" action to parse the message text into the

> desired parts but there are two big problems with this approach:

>

> 1. Very slow

> 2. The program called must then take care of logging the data to the DB.

>

> I can only recommend to implement a custom evaluator object. This approach

> is perfectly suited for your requirements (verfy fast & minimal resource

> usage).

>

> Should you need help in implementing such a custom evaluator object,

please

> contact me.

>

> Franz

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-19T21:01:15Z
Date parsed: 9/19/2003 9:01:15 PM

Date: Sat, 20 Sep 2003 02:01:15 -0400

Hi Franz,

After reading the sample VB code in the SDK, it looks like I don't have to

edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.

As far as the "CustomRuleCondition.cls", there is not much editing unless I

change the function name and/or return type to something else. But if I keep

the function name and return type as is, I can use this sample

"CustomRuleCondition.cls" as is also.

So the only real work is in the "HelperFunctions.bas" file which contains

the algorithm for the function called in the "CustomRuleCondition.cls" file.

So I modify the function in "HelperFunctions.bas" to perform the space

delimited parsing and rename the function name. The individual space

delimited value that is parsed would be returned in the function parameter

variable and written to one of the sixteen custom columns in

"CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change the

function name to the name I specify in the "HelperFunctions.bas" file. That

is it, I think...

I never compiled an ActiveX component before. Would you be able to provide

some help in how to compile this code in VB5 after I have modify the code?

Any more help in this would be appreciated.... Hopefully what I described

above is all the work involved in making this work.

Thanks,

John

"John Smith" <apu000a@hotmail.com> wrote in message

news:$Pwun%23rfDHA.1924@is1.netal.com...

> Franz,

>

> Thanks for the responses. Right now we are either going with Run Program

> (program would be Java applet using JDBC) OR the Custom Evaluator. I am

very

> rusty in my C++ and VB so I am asking one of the developers in my company

to

> help me. I need to speak with him on which approach he is comfortable with

> (he knows both java and C++ but java better).

> I guess I should take a look at the sample source and see if it is

> sufficiently complete for me or my developer to modify to meet our needs

> without extensive work.

> If we decide to go with the custom evaluator and run into a problem, we

will

> definitely contact you for help...

>

> Thanks,

> John

>

> "Franz Krainer" <franzk@netal.com> wrote in message

> news:u7ON5pseDHA.3388@is1.netal.com...

> > > One thing I was thinking of was using the Custom Evaluator. One thoght

> was

> > > to use the Custom Evaluator and somehow have it read the content of

the

> > > MessageText column as it comes in and have it directly write each

space

> > > separated value to its own column in the SQL table. Is this possible?

> >

> > Yes, that's the way to go:

> >

> > Implement a custom evaluator object that takes the message text,

extracts

> > the data to be separated and stores them in the (up to 16) available

> custom

> > fields. Then configure your "Log to ODBC" action to map the used custom

> > fields to your table columns.

> >

> >

> > > Another possibility was using the Custom Evaluator to reformat the

> > incoming

> > > syslog messages so that each of the MessageText space separated values

> > > becomes a comma separated value and I can then maybe use the Custom

> > Mapping

> > > feature in Log to ODBC to map each of these "new" comma separate

values

> > into

> > > the SQL DB. I don't know if this is possible.

> >

> > This won't work.

> >

> > > Can I use the "Run a program" option to parse the incoming syslog

> message,

> > > ie similar to a "pipe" command?

> >

> > You could use a "Run a program" action to parse the message text into

the

> > desired parts but there are two big problems with this approach:

> >

> > 1. Very slow

> > 2. The program called must then take care of logging the data to the DB.

> >

> > I can only recommend to implement a custom evaluator object. This

approach

> > is perfectly suited for your requirements (verfy fast & minimal resource

> > usage).

> >

> > Should you need help in implementing such a custom evaluator object,

> please

> > contact me.

> >

> > Franz

> >

> >

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-21T23:16:14Z
Date parsed: 9/21/2003 11:16:14 PM

Date: Sun, 21 Sep 2003 22:16:14 +0200

Hi John,

> I never compiled an ActiveX component before. Would you be able to provide

> some help in how to compile this code in VB5 after I have modify the code?

> Any more help in this would be appreciated.... Hopefully what I described

> above is all the work involved in making this work.

the sample was written in VB6 and I don't know if the project files of the

sample are compatible with VB5.

I never used VB5 but in VB6 it's very simple to compile the project: Open

it, make your changes and then select File->Make <ProjectName>" and choose

the destination path for the DLL to create.

Franz

"John Smith" <mayabuttreek123@lycos.com> wrote in message

news:wxGBquzfDHA.2640@is1.netal.com...

> Hi Franz,

>

> After reading the sample VB code in the SDK, it looks like I don't have to

> edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.

>

> As far as the "CustomRuleCondition.cls", there is not much editing unless

I

> change the function name and/or return type to something else. But if I

keep

> the function name and return type as is, I can use this sample

> "CustomRuleCondition.cls" as is also.

>

> So the only real work is in the "HelperFunctions.bas" file which contains

> the algorithm for the function called in the "CustomRuleCondition.cls"

file.

>

> So I modify the function in "HelperFunctions.bas" to perform the space

> delimited parsing and rename the function name. The individual space

> delimited value that is parsed would be returned in the function parameter

> variable and written to one of the sixteen custom columns in

> "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change

the

> function name to the name I specify in the "HelperFunctions.bas" file.

That

> is it, I think...

>

> I never compiled an ActiveX component before. Would you be able to provide

> some help in how to compile this code in VB5 after I have modify the code?

> Any more help in this would be appreciated.... Hopefully what I described

> above is all the work involved in making this work.

>

> Thanks,

> John

>

>

> "John Smith" <apu000a@hotmail.com> wrote in message

> news:$Pwun%23rfDHA.1924@is1.netal.com...

> > Franz,

> >

> > Thanks for the responses. Right now we are either going with Run Program

> > (program would be Java applet using JDBC) OR the Custom Evaluator. I am

> very

> > rusty in my C++ and VB so I am asking one of the developers in my

company

> to

> > help me. I need to speak with him on which approach he is comfortable

with

> > (he knows both java and C++ but java better).

> > I guess I should take a look at the sample source and see if it is

> > sufficiently complete for me or my developer to modify to meet our needs

> > without extensive work.

> > If we decide to go with the custom evaluator and run into a problem, we

> will

> > definitely contact you for help...

> >

> > Thanks,

> > John

> >

> > "Franz Krainer" <franzk@netal.com> wrote in message

> > news:u7ON5pseDHA.3388@is1.netal.com...

> > > > One thing I was thinking of was using the Custom Evaluator. One

thoght

> > was

> > > > to use the Custom Evaluator and somehow have it read the content of

> the

> > > > MessageText column as it comes in and have it directly write each

> space

> > > > separated value to its own column in the SQL table. Is this

possible?

> > >

> > > Yes, that's the way to go:

> > >

> > > Implement a custom evaluator object that takes the message text,

> extracts

> > > the data to be separated and stores them in the (up to 16) available

> > custom

> > > fields. Then configure your "Log to ODBC" action to map the used

custom

> > > fields to your table columns.

> > >

> > >

> > > > Another possibility was using the Custom Evaluator to reformat the

> > > incoming

> > > > syslog messages so that each of the MessageText space separated

values

> > > > becomes a comma separated value and I can then maybe use the Custom

> > > Mapping

> > > > feature in Log to ODBC to map each of these "new" comma separate

> values

> > > into

> > > > the SQL DB. I don't know if this is possible.

> > >

> > > This won't work.

> > >

> > > > Can I use the "Run a program" option to parse the incoming syslog

> > message,

> > > > ie similar to a "pipe" command?

> > >

> > > You could use a "Run a program" action to parse the message text into

> the

> > > desired parts but there are two big problems with this approach:

> > >

> > > 1. Very slow

> > > 2. The program called must then take care of logging the data to the

DB.

> > >

> > > I can only recommend to implement a custom evaluator object. This

> approach

> > > is perfectly suited for your requirements (verfy fast & minimal

resource

> > > usage).

> > >

> > > Should you need help in implementing such a custom evaluator object,

> > please

> > > contact me.

> > >

> > > Franz

> > >

> > >

> >

> >

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-25T08:03:16Z
Date parsed: 9/25/2003 8:03:16 AM

Date: Thu, 25 Sep 2003 13:03:16 -0400

Franz,

Is the sample code/Custom Evaluator feature compatible with VB .Net?

Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0 so I

am thinking of modifying your sample code using VB .Net and its new

syntax/functions/etc but before I do that, I want to make there are no

compatibility issues. When I open your VB 6.0 sample code in Visual Studio

..Net, it upgrades it to the new VB .Net.

Please let me know.

Thanks,

John

"Franz Krainer" <franzk@netal.com> wrote in message

news:iUiC10HgDHA.1924@is1.netal.com...

> Hi John,

>

> > I never compiled an ActiveX component before. Would you be able to

provide

> > some help in how to compile this code in VB5 after I have modify the

code?

> > Any more help in this would be appreciated.... Hopefully what I

described

> > above is all the work involved in making this work.

>

> the sample was written in VB6 and I don't know if the project files of the

> sample are compatible with VB5.

>

> I never used VB5 but in VB6 it's very simple to compile the project: Open

> it, make your changes and then select File->Make <ProjectName>" and choose

> the destination path for the DLL to create.

>

> Franz

>

>

>

>

> "John Smith" <mayabuttreek123@lycos.com> wrote in message

> news:wxGBquzfDHA.2640@is1.netal.com...

> > Hi Franz,

> >

> > After reading the sample VB code in the SDK, it looks like I don't have

to

> > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.

> >

> > As far as the "CustomRuleCondition.cls", there is not much editing

unless

> I

> > change the function name and/or return type to something else. But if I

> keep

> > the function name and return type as is, I can use this sample

> > "CustomRuleCondition.cls" as is also.

> >

> > So the only real work is in the "HelperFunctions.bas" file which

contains

> > the algorithm for the function called in the "CustomRuleCondition.cls"

> file.

> >

> > So I modify the function in "HelperFunctions.bas" to perform the space

> > delimited parsing and rename the function name. The individual space

> > delimited value that is parsed would be returned in the function

parameter

> > variable and written to one of the sixteen custom columns in

> > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change

> the

> > function name to the name I specify in the "HelperFunctions.bas" file.

> That

> > is it, I think...

> >

> > I never compiled an ActiveX component before. Would you be able to

provide

> > some help in how to compile this code in VB5 after I have modify the

code?

> > Any more help in this would be appreciated.... Hopefully what I

described

> > above is all the work involved in making this work.

> >

> > Thanks,

> > John

> >

> >

> > "John Smith" <apu000a@hotmail.com> wrote in message

> > news:$Pwun%23rfDHA.1924@is1.netal.com...

> > > Franz,

> > >

> > > Thanks for the responses. Right now we are either going with Run

Program

> > > (program would be Java applet using JDBC) OR the Custom Evaluator. I

am

> > very

> > > rusty in my C++ and VB so I am asking one of the developers in my

> company

> > to

> > > help me. I need to speak with him on which approach he is comfortable

> with

> > > (he knows both java and C++ but java better).

> > > I guess I should take a look at the sample source and see if it is

> > > sufficiently complete for me or my developer to modify to meet our

needs

> > > without extensive work.

> > > If we decide to go with the custom evaluator and run into a problem,

we

> > will

> > > definitely contact you for help...

> > >

> > > Thanks,

> > > John

> > >

> > > "Franz Krainer" <franzk@netal.com> wrote in message

> > > news:u7ON5pseDHA.3388@is1.netal.com...

> > > > > One thing I was thinking of was using the Custom Evaluator. One

> thoght

> > > was

> > > > > to use the Custom Evaluator and somehow have it read the content

of

> > the

> > > > > MessageText column as it comes in and have it directly write each

> > space

> > > > > separated value to its own column in the SQL table. Is this

> possible?

> > > >

> > > > Yes, that's the way to go:

> > > >

> > > > Implement a custom evaluator object that takes the message text,

> > extracts

> > > > the data to be separated and stores them in the (up to 16) available

> > > custom

> > > > fields. Then configure your "Log to ODBC" action to map the used

> custom

> > > > fields to your table columns.

> > > >

> > > >

> > > > > Another possibility was using the Custom Evaluator to reformat the

> > > > incoming

> > > > > syslog messages so that each of the MessageText space separated

> values

> > > > > becomes a comma separated value and I can then maybe use the

Custom

> > > > Mapping

> > > > > feature in Log to ODBC to map each of these "new" comma separate

> > values

> > > > into

> > > > > the SQL DB. I don't know if this is possible.

> > > >

> > > > This won't work.

> > > >

> > > > > Can I use the "Run a program" option to parse the incoming syslog

> > > message,

> > > > > ie similar to a "pipe" command?

> > > >

> > > > You could use a "Run a program" action to parse the message text

into

> > the

> > > > desired parts but there are two big problems with this approach:

> > > >

> > > > 1. Very slow

> > > > 2. The program called must then take care of logging the data to the

> DB.

> > > >

> > > > I can only recommend to implement a custom evaluator object. This

> > approach

> > > > is perfectly suited for your requirements (verfy fast & minimal

> resource

> > > > usage).

> > > >

> > > > Should you need help in implementing such a custom evaluator object,

> > > please

> > > > contact me.

> > > >

> > > > Franz

> > > >

> > > >

> > >

> > >

> >

> >

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-25T22:24:09Z
Date parsed: 9/25/2003 10:24:09 PM

Date: Thu, 25 Sep 2003 21:24:09 +0200

John,

I just verified that using VB.NET as development environment for custom

extension objects works. But there are some steps to take care of, because

of the CLR/COM-interop issues. The easiest way would be to stick with VB6,

if available.

Franz

"John Smith" <apu000a@hotmail.com> wrote in message

news:0RLLqb4gDHA.1924@is1.netal.com...

> Franz,

>

> Is the sample code/Custom Evaluator feature compatible with VB .Net?

> Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0 so

I

> am thinking of modifying your sample code using VB .Net and its new

> syntax/functions/etc but before I do that, I want to make there are no

> compatibility issues. When I open your VB 6.0 sample code in Visual Studio

> .Net, it upgrades it to the new VB .Net.

>

> Please let me know.

>

> Thanks,

> John

>

> "Franz Krainer" <franzk@netal.com> wrote in message

> news:iUiC10HgDHA.1924@is1.netal.com...

> > Hi John,

> >

> > > I never compiled an ActiveX component before. Would you be able to

> provide

> > > some help in how to compile this code in VB5 after I have modify the

> code?

> > > Any more help in this would be appreciated.... Hopefully what I

> described

> > > above is all the work involved in making this work.

> >

> > the sample was written in VB6 and I don't know if the project files of

the

> > sample are compatible with VB5.

> >

> > I never used VB5 but in VB6 it's very simple to compile the project:

Open

> > it, make your changes and then select File->Make <ProjectName>" and

choose

> > the destination path for the DLL to create.

> >

> > Franz

> >

> >

> >

> >

> > "John Smith" <mayabuttreek123@lycos.com> wrote in message

> > news:wxGBquzfDHA.2640@is1.netal.com...

> > > Hi Franz,

> > >

> > > After reading the sample VB code in the SDK, it looks like I don't

have

> to

> > > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.

> > >

> > > As far as the "CustomRuleCondition.cls", there is not much editing

> unless

> > I

> > > change the function name and/or return type to something else. But if

I

> > keep

> > > the function name and return type as is, I can use this sample

> > > "CustomRuleCondition.cls" as is also.

> > >

> > > So the only real work is in the "HelperFunctions.bas" file which

> contains

> > > the algorithm for the function called in the "CustomRuleCondition.cls"

> > file.

> > >

> > > So I modify the function in "HelperFunctions.bas" to perform the space

> > > delimited parsing and rename the function name. The individual space

> > > delimited value that is parsed would be returned in the function

> parameter

> > > variable and written to one of the sixteen custom columns in

> > > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would

change

> > the

> > > function name to the name I specify in the "HelperFunctions.bas" file.

> > That

> > > is it, I think...

> > >

> > > I never compiled an ActiveX component before. Would you be able to

> provide

> > > some help in how to compile this code in VB5 after I have modify the

> code?

> > > Any more help in this would be appreciated.... Hopefully what I

> described

> > > above is all the work involved in making this work.

> > >

> > > Thanks,

> > > John

> > >

> > >

> > > "John Smith" <apu000a@hotmail.com> wrote in message

> > > news:$Pwun%23rfDHA.1924@is1.netal.com...

> > > > Franz,

> > > >

> > > > Thanks for the responses. Right now we are either going with Run

> Program

> > > > (program would be Java applet using JDBC) OR the Custom Evaluator. I

> am

> > > very

> > > > rusty in my C++ and VB so I am asking one of the developers in my

> > company

> > > to

> > > > help me. I need to speak with him on which approach he is

comfortable

> > with

> > > > (he knows both java and C++ but java better).

> > > > I guess I should take a look at the sample source and see if it is

> > > > sufficiently complete for me or my developer to modify to meet our

> needs

> > > > without extensive work.

> > > > If we decide to go with the custom evaluator and run into a problem,

> we

> > > will

> > > > definitely contact you for help...

> > > >

> > > > Thanks,

> > > > John

> > > >

> > > > "Franz Krainer" <franzk@netal.com> wrote in message

> > > > news:u7ON5pseDHA.3388@is1.netal.com...

> > > > > > One thing I was thinking of was using the Custom Evaluator. One

> > thoght

> > > > was

> > > > > > to use the Custom Evaluator and somehow have it read the content

> of

> > > the

> > > > > > MessageText column as it comes in and have it directly write

each

> > > space

> > > > > > separated value to its own column in the SQL table. Is this

> > possible?

> > > > >

> > > > > Yes, that's the way to go:

> > > > >

> > > > > Implement a custom evaluator object that takes the message text,

> > > extracts

> > > > > the data to be separated and stores them in the (up to 16)

available

> > > > custom

> > > > > fields. Then configure your "Log to ODBC" action to map the used

> > custom

> > > > > fields to your table columns.

> > > > >

> > > > >

> > > > > > Another possibility was using the Custom Evaluator to reformat

the

> > > > > incoming

> > > > > > syslog messages so that each of the MessageText space separated

> > values

> > > > > > becomes a comma separated value and I can then maybe use the

> Custom

> > > > > Mapping

> > > > > > feature in Log to ODBC to map each of these "new" comma separate

> > > values

> > > > > into

> > > > > > the SQL DB. I don't know if this is possible.

> > > > >

> > > > > This won't work.

> > > > >

> > > > > > Can I use the "Run a program" option to parse the incoming

syslog

> > > > message,

> > > > > > ie similar to a "pipe" command?

> > > > >

> > > > > You could use a "Run a program" action to parse the message text

> into

> > > the

> > > > > desired parts but there are two big problems with this approach:

> > > > >

> > > > > 1. Very slow

> > > > > 2. The program called must then take care of logging the data to

the

> > DB.

> > > > >

> > > > > I can only recommend to implement a custom evaluator object. This

> > > approach

> > > > > is perfectly suited for your requirements (verfy fast & minimal

> > resource

> > > > > usage).

> > > > >

> > > > > Should you need help in implementing such a custom evaluator

object,

> > > > please

> > > > > contact me.

> > > > >

> > > > > Franz

> > > > >

> > > > >

> > > >

> > > >

> > >

> > >

> >

> >

>

>

Guest
  • Guest
  • Guest Topic Starter
2003-09-26T06:18:03Z
Date parsed: 9/26/2003 6:18:03 AM

Date: Fri, 26 Sep 2003 11:18:03 -0400

Thanks again Franz...

Found a copy of the VB6 Pro so as you suggested, we will stick with this...

John

"Franz Krainer" <franzk@netal.com> wrote in message

news:lAQAYq5gDHA.1924@is1.netal.com...

> John,

>

> I just verified that using VB.NET as development environment for custom

> extension objects works. But there are some steps to take care of, because

> of the CLR/COM-interop issues. The easiest way would be to stick with VB6,

> if available.

>

> Franz

>

>

> "John Smith" <apu000a@hotmail.com> wrote in message

> news:0RLLqb4gDHA.1924@is1.netal.com...

> > Franz,

> >

> > Is the sample code/Custom Evaluator feature compatible with VB .Net?

> > Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0

so

> I

> > am thinking of modifying your sample code using VB .Net and its new

> > syntax/functions/etc but before I do that, I want to make there are no

> > compatibility issues. When I open your VB 6.0 sample code in Visual

Studio

> > .Net, it upgrades it to the new VB .Net.

> >

> > Please let me know.

> >

> > Thanks,

> > John

> >

> > "Franz Krainer" <franzk@netal.com> wrote in message

> > news:iUiC10HgDHA.1924@is1.netal.com...

> > > Hi John,

> > >

> > > > I never compiled an ActiveX component before. Would you be able to

> > provide

> > > > some help in how to compile this code in VB5 after I have modify the

> > code?

> > > > Any more help in this would be appreciated.... Hopefully what I

> > described

> > > > above is all the work involved in making this work.

> > >

> > > the sample was written in VB6 and I don't know if the project files of

> the

> > > sample are compatible with VB5.

> > >

> > > I never used VB5 but in VB6 it's very simple to compile the project:

> Open

> > > it, make your changes and then select File->Make <ProjectName>" and

> choose

> > > the destination path for the DLL to create.

> > >

> > > Franz

> > >

> > >

> > >

> > >

> > > "John Smith" <mayabuttreek123@lycos.com> wrote in message

> > > news:wxGBquzfDHA.2640@is1.netal.com...

> > > > Hi Franz,

> > > >

> > > > After reading the sample VB code in the SDK, it looks like I don't

> have

> > to

> > > > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as

is.

> > > >

> > > > As far as the "CustomRuleCondition.cls", there is not much editing

> > unless

> > > I

> > > > change the function name and/or return type to something else. But

if

> I

> > > keep

> > > > the function name and return type as is, I can use this sample

> > > > "CustomRuleCondition.cls" as is also.

> > > >

> > > > So the only real work is in the "HelperFunctions.bas" file which

> > contains

> > > > the algorithm for the function called in the

"CustomRuleCondition.cls"

> > > file.

> > > >

> > > > So I modify the function in "HelperFunctions.bas" to perform the

space

> > > > delimited parsing and rename the function name. The individual space

> > > > delimited value that is parsed would be returned in the function

> > parameter

> > > > variable and written to one of the sixteen custom columns in

> > > > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would

> change

> > > the

> > > > function name to the name I specify in the "HelperFunctions.bas"

file.

> > > That

> > > > is it, I think...

> > > >

> > > > I never compiled an ActiveX component before. Would you be able to

> > provide

> > > > some help in how to compile this code in VB5 after I have modify the

> > code?

> > > > Any more help in this would be appreciated.... Hopefully what I

> > described

> > > > above is all the work involved in making this work.

> > > >

> > > > Thanks,

> > > > John

> > > >

> > > >

> > > > "John Smith" <apu000a@hotmail.com> wrote in message

> > > > news:$Pwun%23rfDHA.1924@is1.netal.com...

> > > > > Franz,

> > > > >

> > > > > Thanks for the responses. Right now we are either going with Run

> > Program

> > > > > (program would be Java applet using JDBC) OR the Custom Evaluator.

I

> > am

> > > > very

> > > > > rusty in my C++ and VB so I am asking one of the developers in my

> > > company

> > > > to

> > > > > help me. I need to speak with him on which approach he is

> comfortable

> > > with

> > > > > (he knows both java and C++ but java better).

> > > > > I guess I should take a look at the sample source and see if it is

> > > > > sufficiently complete for me or my developer to modify to meet our

> > needs

> > > > > without extensive work.

> > > > > If we decide to go with the custom evaluator and run into a

problem,

> > we

> > > > will

> > > > > definitely contact you for help...

> > > > >

> > > > > Thanks,

> > > > > John

> > > > >

> > > > > "Franz Krainer" <franzk@netal.com> wrote in message

> > > > > news:u7ON5pseDHA.3388@is1.netal.com...

> > > > > > > One thing I was thinking of was using the Custom Evaluator.

One

> > > thoght

> > > > > was

> > > > > > > to use the Custom Evaluator and somehow have it read the

content

> > of

> > > > the

> > > > > > > MessageText column as it comes in and have it directly write

> each

> > > > space

> > > > > > > separated value to its own column in the SQL table. Is this

> > > possible?

> > > > > >

> > > > > > Yes, that's the way to go:

> > > > > >

> > > > > > Implement a custom evaluator object that takes the message text,

> > > > extracts

> > > > > > the data to be separated and stores them in the (up to 16)

> available

> > > > > custom

> > > > > > fields. Then configure your "Log to ODBC" action to map the used

> > > custom

> > > > > > fields to your table columns.

> > > > > >

> > > > > >

> > > > > > > Another possibility was using the Custom Evaluator to reformat

> the

> > > > > > incoming

> > > > > > > syslog messages so that each of the MessageText space

separated

> > > values

> > > > > > > becomes a comma separated value and I can then maybe use the

> > Custom

> > > > > > Mapping

> > > > > > > feature in Log to ODBC to map each of these "new" comma

separate

> > > > values

> > > > > > into

> > > > > > > the SQL DB. I don't know if this is possible.

> > > > > >

> > > > > > This won't work.

> > > > > >

> > > > > > > Can I use the "Run a program" option to parse the incoming

> syslog

> > > > > message,

> > > > > > > ie similar to a "pipe" command?

> > > > > >

> > > > > > You could use a "Run a program" action to parse the message text

> > into

> > > > the

> > > > > > desired parts but there are two big problems with this approach:

> > > > > >

> > > > > > 1. Very slow

> > > > > > 2. The program called must then take care of logging the data to

> the

> > > DB.

> > > > > >

> > > > > > I can only recommend to implement a custom evaluator object.

This

> > > > approach

> > > > > > is perfectly suited for your requirements (verfy fast & minimal

> > > resource

> > > > > > usage).

> > > > > >

> > > > > > Should you need help in implementing such a custom evaluator

> object,

> > > > > please

> > > > > > contact me.

> > > > > >

> > > > > > Franz

> > > > > >

> > > > > >

> > > > >

> > > > >

> > > >

> > > >

> > >

> > >

> >

> >

>

>

Similar Topics