Date parsed: 9/11/2003 9:13:16 AM
Date: Thu, 11 Sep 2003 14:13:16 -0400

I have this issue and I don't know what the best solution is. I hope I can
explain my question clearly.

I currently syslog all of device syslog messages into an ODBC (SQL2K) DB
(created with the sql script that came with the product) and this works
fine.
All of the individual syslog message components are correctly mapped to its
corresponding SQL Table column. In the MessageText column, it contains the
important syslog message content that I want to query thru SQL. The format
of content in the MessageText column is a string consists of space separated
values. Example:

Complete Syslog message:
9/10/2003,12:02:23 AM,172.29.160.10,XYZ.bbb.org,LOCAL7,NOTICE,3495000
09/10/2003 00:02:22.950 SEV=4 AUTH/28 RPT=43824 32.101.165.122 User [ABC]
Group [CNN] disconnected: Duration: 0:01:14 Bytes xmt: 23632 Bytes rcv:
28400 Reason: User Requested

MessageText column of the syslog message above. In the column it contains
the following space separated values:
3495000 09/10/2003 00:02:22.950 SEV=4 AUTH/28 RPT=43824 32.101.165.122 User
[ABC] Group [CNN] disconnected: Duration: 0:01:14 Bytes xmt: 23632 Bytes
rcv: 28400 Reason: User Requested

Currently this whole string is in the MessageText column which makes it
difficult to perform SQL query against the values contained within the
string.
So what I would like to do is be able to map the individual space separate
value in this string in the MessageText column to its own colum either in
the same table or in another table. Please note, I can't use the custom
mapping option in the log to ODBC feature since that maps a syslog column to
a SQL colum which is working for me. What I need to do is then take the
content in one of the syslog column (MessageText), further separating them
and map each to its own SQL column which I can't do with ODBC custom mapping
feature. I want to do this in SL4NT before it gets into the SQL DB.

Can you recommend a solution for this situation using SL4NT?

One thing I was thinking of was using the Custom Evaluator. One thoght was
to use the Custom Evaluator and somehow have it read the content of the
MessageText column as it comes in and have it directly write each space
separated value to its own column in the SQL table. Is this possible?
Another possibility was using the Custom Evaluator to reformat the incoming
syslog messages so that each of the MessageText space separated values
becomes a comma separated value and I can then maybe use the Custom Mapping
feature in Log to ODBC to map each of these "new" comma separate values into
the SQL DB. I don't know if this is possible.

Do you have any other ideas (simplier?) for SL4NT that I can use to
accomplish my goal?

Can I use the "Run a program" option to parse the incoming syslog message,
ie similar to a "pipe" command?

This is a long message but I am stuck..

Thanks,
John

Date parsed: 9/11/2003 11:24:22 PM
Date: Thu, 11 Sep 2003 22:24:22 +0200


"John Smith" <apu000a@hotmail.com> wrote in message
news:qx5ChBJeDHA.1920@is1.netal.com...
<snip>
> So what I would like to do is be able to map the individual space
separate
> value in this string in the MessageText column to its own colum either
in
> the same table or in another table.

<snip>

> Can I use the "Run a program" option to parse the incoming syslog
message,
> ie similar to a "pipe" command?
>
> This is a long message but I am stuck..
>
> Thanks,
> John
>

You should definately be able to get the wanted results via the run a
program option.
I am doing something similar, on some specific Syslog messages i want
to receive a SNMP-trap in my management system. I build a small script
(using Franz' scripting tool) which does first some string-manipulation,
and than generates an SNMP-trap.
In stead of sending a trap, you should be able to build a new syslog
message, and catch that in SL4NT to send it to the ODBC.... The original
(unmodified) syslog message is than ofcourse not send to the ODBC...

Let us know if you succeeded....

Martin

Date parsed: 9/12/2003 7:11:37 AM
Date: Fri, 12 Sep 2003 12:11:37 -0400

Thanks... What I might end up doing is to use this option, call a java
applet that pases the syslog string and write the parsed and needed space
separated value in the MessageText to its corresponding column in the SQL DB
thru JDBC... This might be simplier than using the Custom Evaluator or the
Custom Action Handlers since our expertise is more in Java than C++ or VB.
The only concern I have is the overhead and efficiency. It looks like using
the Custom Action/Evaluator Handlers might be more efficient since it is
launched at the SL4NT service startup (if I read it right) and compared that
with the Run Program option which seems to launch then terminate the called
application each time the rule is triggered...
John

"Martin" <martin@notfor.spam.local> wrote in message
news:L7eUwKKeDHA.1924@is1.netal.com...
>
> "John Smith" <apu000a@hotmail.com> wrote in message
> news:qx5ChBJeDHA.1920@is1.netal.com...
> <snip>
> > So what I would like to do is be able to map the individual space
> separate
> > value in this string in the MessageText column to its own colum either
> in
> > the same table or in another table.
>
> <snip>
>
> > Can I use the "Run a program" option to parse the incoming syslog
> message,
> > ie similar to a "pipe" command?
> >
> > This is a long message but I am stuck..
> >
> > Thanks,
> > John
> >
>
> You should definately be able to get the wanted results via the run a
> program option.
> I am doing something similar, on some specific Syslog messages i want
> to receive a SNMP-trap in my management system. I build a small script
> (using Franz' scripting tool) which does first some string-manipulation,
> and than generates an SNMP-trap.
> In stead of sending a trap, you should be able to build a new syslog
> message, and catch that in SL4NT to send it to the ODBC.... The original
> (unmodified) syslog message is than ofcourse not send to the ODBC...
>
> Let us know if you succeeded....
>
> Martin
>
>

Date parsed: 9/14/2003 5:14:13 PM
Date: Sun, 14 Sep 2003 16:14:13 +0200

> One thing I was thinking of was using the Custom Evaluator. One thoght was
> to use the Custom Evaluator and somehow have it read the content of the
> MessageText column as it comes in and have it directly write each space
> separated value to its own column in the SQL table. Is this possible?

Yes, that's the way to go:

Implement a custom evaluator object that takes the message text, extracts
the data to be separated and stores them in the (up to 16) available custom
fields. Then configure your "Log to ODBC" action to map the used custom
fields to your table columns.


> Another possibility was using the Custom Evaluator to reformat the
incoming
> syslog messages so that each of the MessageText space separated values
> becomes a comma separated value and I can then maybe use the Custom
Mapping
> feature in Log to ODBC to map each of these "new" comma separate values
into
> the SQL DB. I don't know if this is possible.

This won't work.

> Can I use the "Run a program" option to parse the incoming syslog message,
> ie similar to a "pipe" command?

You could use a "Run a program" action to parse the message text into the
desired parts but there are two big problems with this approach:

1. Very slow
2. The program called must then take care of logging the data to the DB.

I can only recommend to implement a custom evaluator object. This approach
is perfectly suited for your requirements (verfy fast & minimal resource
usage).

Should you need help in implementing such a custom evaluator object, please
contact me.

Franz

Date parsed: 9/19/2003 6:06:50 AM
Date: Fri, 19 Sep 2003 11:06:50 -0400

Franz,

Thanks for the responses. Right now we are either going with Run Program
(program would be Java applet using JDBC) OR the Custom Evaluator. I am very
rusty in my C++ and VB so I am asking one of the developers in my company to
help me. I need to speak with him on which approach he is comfortable with
(he knows both java and C++ but java better).
I guess I should take a look at the sample source and see if it is
sufficiently complete for me or my developer to modify to meet our needs
without extensive work.
If we decide to go with the custom evaluator and run into a problem, we will
definitely contact you for help...

Thanks,
John

"Franz Krainer" <franzk@netal.com> wrote in message
news:u7ON5pseDHA.3388@is1.netal.com...
> > One thing I was thinking of was using the Custom Evaluator. One thoght
was
> > to use the Custom Evaluator and somehow have it read the content of the
> > MessageText column as it comes in and have it directly write each space
> > separated value to its own column in the SQL table. Is this possible?
>
> Yes, that's the way to go:
>
> Implement a custom evaluator object that takes the message text, extracts
> the data to be separated and stores them in the (up to 16) available
custom
> fields. Then configure your "Log to ODBC" action to map the used custom
> fields to your table columns.
>
>
> > Another possibility was using the Custom Evaluator to reformat the
> incoming
> > syslog messages so that each of the MessageText space separated values
> > becomes a comma separated value and I can then maybe use the Custom
> Mapping
> > feature in Log to ODBC to map each of these "new" comma separate values
> into
> > the SQL DB. I don't know if this is possible.
>
> This won't work.
>
> > Can I use the "Run a program" option to parse the incoming syslog
message,
> > ie similar to a "pipe" command?
>
> You could use a "Run a program" action to parse the message text into the
> desired parts but there are two big problems with this approach:
>
> 1. Very slow
> 2. The program called must then take care of logging the data to the DB.
>
> I can only recommend to implement a custom evaluator object. This approach
> is perfectly suited for your requirements (verfy fast & minimal resource
> usage).
>
> Should you need help in implementing such a custom evaluator object,
please
> contact me.
>
> Franz
>
>

Date parsed: 9/19/2003 9:01:15 PM
Date: Sat, 20 Sep 2003 02:01:15 -0400

Hi Franz,

After reading the sample VB code in the SDK, it looks like I don't have to
edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.

As far as the "CustomRuleCondition.cls", there is not much editing unless I
change the function name and/or return type to something else. But if I keep
the function name and return type as is, I can use this sample
"CustomRuleCondition.cls" as is also.

So the only real work is in the "HelperFunctions.bas" file which contains
the algorithm for the function called in the "CustomRuleCondition.cls" file.

So I modify the function in "HelperFunctions.bas" to perform the space
delimited parsing and rename the function name. The individual space
delimited value that is parsed would be returned in the function parameter
variable and written to one of the sixteen custom columns in
"CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change the
function name to the name I specify in the "HelperFunctions.bas" file. That
is it, I think...

I never compiled an ActiveX component before. Would you be able to provide
some help in how to compile this code in VB5 after I have modify the code?
Any more help in this would be appreciated.... Hopefully what I described
above is all the work involved in making this work.

Thanks,
John


"John Smith" <apu000a@hotmail.com> wrote in message
news:$Pwun%23rfDHA.1924@is1.netal.com...
> Franz,
>
> Thanks for the responses. Right now we are either going with Run Program
> (program would be Java applet using JDBC) OR the Custom Evaluator. I am
very
> rusty in my C++ and VB so I am asking one of the developers in my company
to
> help me. I need to speak with him on which approach he is comfortable with
> (he knows both java and C++ but java better).
> I guess I should take a look at the sample source and see if it is
> sufficiently complete for me or my developer to modify to meet our needs
> without extensive work.
> If we decide to go with the custom evaluator and run into a problem, we
will
> definitely contact you for help...
>
> Thanks,
> John
>
> "Franz Krainer" <franzk@netal.com> wrote in message
> news:u7ON5pseDHA.3388@is1.netal.com...
> > > One thing I was thinking of was using the Custom Evaluator. One thoght
> was
> > > to use the Custom Evaluator and somehow have it read the content of
the
> > > MessageText column as it comes in and have it directly write each
space
> > > separated value to its own column in the SQL table. Is this possible?
> >
> > Yes, that's the way to go:
> >
> > Implement a custom evaluator object that takes the message text,
extracts
> > the data to be separated and stores them in the (up to 16) available
> custom
> > fields. Then configure your "Log to ODBC" action to map the used custom
> > fields to your table columns.
> >
> >
> > > Another possibility was using the Custom Evaluator to reformat the
> > incoming
> > > syslog messages so that each of the MessageText space separated values
> > > becomes a comma separated value and I can then maybe use the Custom
> > Mapping
> > > feature in Log to ODBC to map each of these "new" comma separate
values
> > into
> > > the SQL DB. I don't know if this is possible.
> >
> > This won't work.
> >
> > > Can I use the "Run a program" option to parse the incoming syslog
> message,
> > > ie similar to a "pipe" command?
> >
> > You could use a "Run a program" action to parse the message text into
the
> > desired parts but there are two big problems with this approach:
> >
> > 1. Very slow
> > 2. The program called must then take care of logging the data to the DB.
> >
> > I can only recommend to implement a custom evaluator object. This
approach
> > is perfectly suited for your requirements (verfy fast & minimal resource
> > usage).
> >
> > Should you need help in implementing such a custom evaluator object,
> please
> > contact me.
> >
> > Franz
> >
> >
>
>

Date parsed: 9/21/2003 11:16:14 PM
Date: Sun, 21 Sep 2003 22:16:14 +0200

Hi John,

> I never compiled an ActiveX component before. Would you be able to provide
> some help in how to compile this code in VB5 after I have modify the code?
> Any more help in this would be appreciated.... Hopefully what I described
> above is all the work involved in making this work.

the sample was written in VB6 and I don't know if the project files of the
sample are compatible with VB5.

I never used VB5 but in VB6 it's very simple to compile the project: Open
it, make your changes and then select File->Make <ProjectName>" and choose
the destination path for the DLL to create.

Franz




"John Smith" <mayabuttreek123@lycos.com> wrote in message
news:wxGBquzfDHA.2640@is1.netal.com...
> Hi Franz,
>
> After reading the sample VB code in the SDK, it looks like I don't have to
> edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.
>
> As far as the "CustomRuleCondition.cls", there is not much editing unless
I
> change the function name and/or return type to something else. But if I
keep
> the function name and return type as is, I can use this sample
> "CustomRuleCondition.cls" as is also.
>
> So the only real work is in the "HelperFunctions.bas" file which contains
> the algorithm for the function called in the "CustomRuleCondition.cls"
file.
>
> So I modify the function in "HelperFunctions.bas" to perform the space
> delimited parsing and rename the function name. The individual space
> delimited value that is parsed would be returned in the function parameter
> variable and written to one of the sixteen custom columns in
> "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change
the
> function name to the name I specify in the "HelperFunctions.bas" file.
That
> is it, I think...
>
> I never compiled an ActiveX component before. Would you be able to provide
> some help in how to compile this code in VB5 after I have modify the code?
> Any more help in this would be appreciated.... Hopefully what I described
> above is all the work involved in making this work.
>
> Thanks,
> John
>
>
> "John Smith" <apu000a@hotmail.com> wrote in message
> news:$Pwun%23rfDHA.1924@is1.netal.com...
> > Franz,
> >
> > Thanks for the responses. Right now we are either going with Run Program
> > (program would be Java applet using JDBC) OR the Custom Evaluator. I am
> very
> > rusty in my C++ and VB so I am asking one of the developers in my
company
> to
> > help me. I need to speak with him on which approach he is comfortable
with
> > (he knows both java and C++ but java better).
> > I guess I should take a look at the sample source and see if it is
> > sufficiently complete for me or my developer to modify to meet our needs
> > without extensive work.
> > If we decide to go with the custom evaluator and run into a problem, we
> will
> > definitely contact you for help...
> >
> > Thanks,
> > John
> >
> > "Franz Krainer" <franzk@netal.com> wrote in message
> > news:u7ON5pseDHA.3388@is1.netal.com...
> > > > One thing I was thinking of was using the Custom Evaluator. One
thoght
> > was
> > > > to use the Custom Evaluator and somehow have it read the content of
> the
> > > > MessageText column as it comes in and have it directly write each
> space
> > > > separated value to its own column in the SQL table. Is this
possible?
> > >
> > > Yes, that's the way to go:
> > >
> > > Implement a custom evaluator object that takes the message text,
> extracts
> > > the data to be separated and stores them in the (up to 16) available
> > custom
> > > fields. Then configure your "Log to ODBC" action to map the used
custom
> > > fields to your table columns.
> > >
> > >
> > > > Another possibility was using the Custom Evaluator to reformat the
> > > incoming
> > > > syslog messages so that each of the MessageText space separated
values
> > > > becomes a comma separated value and I can then maybe use the Custom
> > > Mapping
> > > > feature in Log to ODBC to map each of these "new" comma separate
> values
> > > into
> > > > the SQL DB. I don't know if this is possible.
> > >
> > > This won't work.
> > >
> > > > Can I use the "Run a program" option to parse the incoming syslog
> > message,
> > > > ie similar to a "pipe" command?
> > >
> > > You could use a "Run a program" action to parse the message text into
> the
> > > desired parts but there are two big problems with this approach:
> > >
> > > 1. Very slow
> > > 2. The program called must then take care of logging the data to the
DB.
> > >
> > > I can only recommend to implement a custom evaluator object. This
> approach
> > > is perfectly suited for your requirements (verfy fast & minimal
resource
> > > usage).
> > >
> > > Should you need help in implementing such a custom evaluator object,
> > please
> > > contact me.
> > >
> > > Franz
> > >
> > >
> >
> >
>
>

Date parsed: 9/25/2003 8:03:16 AM
Date: Thu, 25 Sep 2003 13:03:16 -0400

Franz,

Is the sample code/Custom Evaluator feature compatible with VB .Net?
Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0 so I
am thinking of modifying your sample code using VB .Net and its new
syntax/functions/etc but before I do that, I want to make there are no
compatibility issues. When I open your VB 6.0 sample code in Visual Studio
..Net, it upgrades it to the new VB .Net.

Please let me know.

Thanks,
John

"Franz Krainer" <franzk@netal.com> wrote in message
news:iUiC10HgDHA.1924@is1.netal.com...
> Hi John,
>
> > I never compiled an ActiveX component before. Would you be able to
provide
> > some help in how to compile this code in VB5 after I have modify the
code?
> > Any more help in this would be appreciated.... Hopefully what I
described
> > above is all the work involved in making this work.
>
> the sample was written in VB6 and I don't know if the project files of the
> sample are compatible with VB5.
>
> I never used VB5 but in VB6 it's very simple to compile the project: Open
> it, make your changes and then select File->Make <ProjectName>" and choose
> the destination path for the DLL to create.
>
> Franz
>
>
>
>
> "John Smith" <mayabuttreek123@lycos.com> wrote in message
> news:wxGBquzfDHA.2640@is1.netal.com...
> > Hi Franz,
> >
> > After reading the sample VB code in the SDK, it looks like I don't have
to
> > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.
> >
> > As far as the "CustomRuleCondition.cls", there is not much editing
unless
> I
> > change the function name and/or return type to something else. But if I
> keep
> > the function name and return type as is, I can use this sample
> > "CustomRuleCondition.cls" as is also.
> >
> > So the only real work is in the "HelperFunctions.bas" file which
contains
> > the algorithm for the function called in the "CustomRuleCondition.cls"
> file.
> >
> > So I modify the function in "HelperFunctions.bas" to perform the space
> > delimited parsing and rename the function name. The individual space
> > delimited value that is parsed would be returned in the function
parameter
> > variable and written to one of the sixteen custom columns in
> > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would change
> the
> > function name to the name I specify in the "HelperFunctions.bas" file.
> That
> > is it, I think...
> >
> > I never compiled an ActiveX component before. Would you be able to
provide
> > some help in how to compile this code in VB5 after I have modify the
code?
> > Any more help in this would be appreciated.... Hopefully what I
described
> > above is all the work involved in making this work.
> >
> > Thanks,
> > John
> >
> >
> > "John Smith" <apu000a@hotmail.com> wrote in message
> > news:$Pwun%23rfDHA.1924@is1.netal.com...
> > > Franz,
> > >
> > > Thanks for the responses. Right now we are either going with Run
Program
> > > (program would be Java applet using JDBC) OR the Custom Evaluator. I
am
> > very
> > > rusty in my C++ and VB so I am asking one of the developers in my
> company
> > to
> > > help me. I need to speak with him on which approach he is comfortable
> with
> > > (he knows both java and C++ but java better).
> > > I guess I should take a look at the sample source and see if it is
> > > sufficiently complete for me or my developer to modify to meet our
needs
> > > without extensive work.
> > > If we decide to go with the custom evaluator and run into a problem,
we
> > will
> > > definitely contact you for help...
> > >
> > > Thanks,
> > > John
> > >
> > > "Franz Krainer" <franzk@netal.com> wrote in message
> > > news:u7ON5pseDHA.3388@is1.netal.com...
> > > > > One thing I was thinking of was using the Custom Evaluator. One
> thoght
> > > was
> > > > > to use the Custom Evaluator and somehow have it read the content
of
> > the
> > > > > MessageText column as it comes in and have it directly write each
> > space
> > > > > separated value to its own column in the SQL table. Is this
> possible?
> > > >
> > > > Yes, that's the way to go:
> > > >
> > > > Implement a custom evaluator object that takes the message text,
> > extracts
> > > > the data to be separated and stores them in the (up to 16) available
> > > custom
> > > > fields. Then configure your "Log to ODBC" action to map the used
> custom
> > > > fields to your table columns.
> > > >
> > > >
> > > > > Another possibility was using the Custom Evaluator to reformat the
> > > > incoming
> > > > > syslog messages so that each of the MessageText space separated
> values
> > > > > becomes a comma separated value and I can then maybe use the
Custom
> > > > Mapping
> > > > > feature in Log to ODBC to map each of these "new" comma separate
> > values
> > > > into
> > > > > the SQL DB. I don't know if this is possible.
> > > >
> > > > This won't work.
> > > >
> > > > > Can I use the "Run a program" option to parse the incoming syslog
> > > message,
> > > > > ie similar to a "pipe" command?
> > > >
> > > > You could use a "Run a program" action to parse the message text
into
> > the
> > > > desired parts but there are two big problems with this approach:
> > > >
> > > > 1. Very slow
> > > > 2. The program called must then take care of logging the data to the
> DB.
> > > >
> > > > I can only recommend to implement a custom evaluator object. This
> > approach
> > > > is perfectly suited for your requirements (verfy fast & minimal
> resource
> > > > usage).
> > > >
> > > > Should you need help in implementing such a custom evaluator object,
> > > please
> > > > contact me.
> > > >
> > > > Franz
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Date parsed: 9/25/2003 10:24:09 PM
Date: Thu, 25 Sep 2003 21:24:09 +0200

John,

I just verified that using VB.NET as development environment for custom
extension objects works. But there are some steps to take care of, because
of the CLR/COM-interop issues. The easiest way would be to stick with VB6,
if available.

Franz


"John Smith" <apu000a@hotmail.com> wrote in message
news:0RLLqb4gDHA.1924@is1.netal.com...
> Franz,
>
> Is the sample code/Custom Evaluator feature compatible with VB .Net?
> Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0 so
I
> am thinking of modifying your sample code using VB .Net and its new
> syntax/functions/etc but before I do that, I want to make there are no
> compatibility issues. When I open your VB 6.0 sample code in Visual Studio
> .Net, it upgrades it to the new VB .Net.
>
> Please let me know.
>
> Thanks,
> John
>
> "Franz Krainer" <franzk@netal.com> wrote in message
> news:iUiC10HgDHA.1924@is1.netal.com...
> > Hi John,
> >
> > > I never compiled an ActiveX component before. Would you be able to
> provide
> > > some help in how to compile this code in VB5 after I have modify the
> code?
> > > Any more help in this would be appreciated.... Hopefully what I
> described
> > > above is all the work involved in making this work.
> >
> > the sample was written in VB6 and I don't know if the project files of
the
> > sample are compatible with VB5.
> >
> > I never used VB5 but in VB6 it's very simple to compile the project:
Open
> > it, make your changes and then select File->Make <ProjectName>" and
choose
> > the destination path for the DLL to create.
> >
> > Franz
> >
> >
> >
> >
> > "John Smith" <mayabuttreek123@lycos.com> wrote in message
> > news:wxGBquzfDHA.2640@is1.netal.com...
> > > Hi Franz,
> > >
> > > After reading the sample VB code in the SDK, it looks like I don't
have
> to
> > > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as is.
> > >
> > > As far as the "CustomRuleCondition.cls", there is not much editing
> unless
> > I
> > > change the function name and/or return type to something else. But if
I
> > keep
> > > the function name and return type as is, I can use this sample
> > > "CustomRuleCondition.cls" as is also.
> > >
> > > So the only real work is in the "HelperFunctions.bas" file which
> contains
> > > the algorithm for the function called in the "CustomRuleCondition.cls"
> > file.
> > >
> > > So I modify the function in "HelperFunctions.bas" to perform the space
> > > delimited parsing and rename the function name. The individual space
> > > delimited value that is parsed would be returned in the function
> parameter
> > > variable and written to one of the sixteen custom columns in
> > > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would
change
> > the
> > > function name to the name I specify in the "HelperFunctions.bas" file.
> > That
> > > is it, I think...
> > >
> > > I never compiled an ActiveX component before. Would you be able to
> provide
> > > some help in how to compile this code in VB5 after I have modify the
> code?
> > > Any more help in this would be appreciated.... Hopefully what I
> described
> > > above is all the work involved in making this work.
> > >
> > > Thanks,
> > > John
> > >
> > >
> > > "John Smith" <apu000a@hotmail.com> wrote in message
> > > news:$Pwun%23rfDHA.1924@is1.netal.com...
> > > > Franz,
> > > >
> > > > Thanks for the responses. Right now we are either going with Run
> Program
> > > > (program would be Java applet using JDBC) OR the Custom Evaluator. I
> am
> > > very
> > > > rusty in my C++ and VB so I am asking one of the developers in my
> > company
> > > to
> > > > help me. I need to speak with him on which approach he is
comfortable
> > with
> > > > (he knows both java and C++ but java better).
> > > > I guess I should take a look at the sample source and see if it is
> > > > sufficiently complete for me or my developer to modify to meet our
> needs
> > > > without extensive work.
> > > > If we decide to go with the custom evaluator and run into a problem,
> we
> > > will
> > > > definitely contact you for help...
> > > >
> > > > Thanks,
> > > > John
> > > >
> > > > "Franz Krainer" <franzk@netal.com> wrote in message
> > > > news:u7ON5pseDHA.3388@is1.netal.com...
> > > > > > One thing I was thinking of was using the Custom Evaluator. One
> > thoght
> > > > was
> > > > > > to use the Custom Evaluator and somehow have it read the content
> of
> > > the
> > > > > > MessageText column as it comes in and have it directly write
each
> > > space
> > > > > > separated value to its own column in the SQL table. Is this
> > possible?
> > > > >
> > > > > Yes, that's the way to go:
> > > > >
> > > > > Implement a custom evaluator object that takes the message text,
> > > extracts
> > > > > the data to be separated and stores them in the (up to 16)
available
> > > > custom
> > > > > fields. Then configure your "Log to ODBC" action to map the used
> > custom
> > > > > fields to your table columns.
> > > > >
> > > > >
> > > > > > Another possibility was using the Custom Evaluator to reformat
the
> > > > > incoming
> > > > > > syslog messages so that each of the MessageText space separated
> > values
> > > > > > becomes a comma separated value and I can then maybe use the
> Custom
> > > > > Mapping
> > > > > > feature in Log to ODBC to map each of these "new" comma separate
> > > values
> > > > > into
> > > > > > the SQL DB. I don't know if this is possible.
> > > > >
> > > > > This won't work.
> > > > >
> > > > > > Can I use the "Run a program" option to parse the incoming
syslog
> > > > message,
> > > > > > ie similar to a "pipe" command?
> > > > >
> > > > > You could use a "Run a program" action to parse the message text
> into
> > > the
> > > > > desired parts but there are two big problems with this approach:
> > > > >
> > > > > 1. Very slow
> > > > > 2. The program called must then take care of logging the data to
the
> > DB.
> > > > >
> > > > > I can only recommend to implement a custom evaluator object. This
> > > approach
> > > > > is perfectly suited for your requirements (verfy fast & minimal
> > resource
> > > > > usage).
> > > > >
> > > > > Should you need help in implementing such a custom evaluator
object,
> > > > please
> > > > > contact me.
> > > > >
> > > > > Franz
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Date parsed: 9/26/2003 6:18:03 AM
Date: Fri, 26 Sep 2003 11:18:03 -0400

Thanks again Franz...
Found a copy of the VB6 Pro so as you suggested, we will stick with this...

John
"Franz Krainer" <franzk@netal.com> wrote in message
news:lAQAYq5gDHA.1924@is1.netal.com...
> John,
>
> I just verified that using VB.NET as development environment for custom
> extension objects works. But there are some steps to take care of, because
> of the CLR/COM-interop issues. The easiest way would be to stick with VB6,
> if available.
>
> Franz
>
>
> "John Smith" <apu000a@hotmail.com> wrote in message
> news:0RLLqb4gDHA.1924@is1.netal.com...
> > Franz,
> >
> > Is the sample code/Custom Evaluator feature compatible with VB .Net?
> > Apparently VB 6.0 is replaced by VB .Net. I have VB .Net but not VB 6.0
so
> I
> > am thinking of modifying your sample code using VB .Net and its new
> > syntax/functions/etc but before I do that, I want to make there are no
> > compatibility issues. When I open your VB 6.0 sample code in Visual
Studio
> > .Net, it upgrades it to the new VB .Net.
> >
> > Please let me know.
> >
> > Thanks,
> > John
> >
> > "Franz Krainer" <franzk@netal.com> wrote in message
> > news:iUiC10HgDHA.1924@is1.netal.com...
> > > Hi John,
> > >
> > > > I never compiled an ActiveX component before. Would you be able to
> > provide
> > > > some help in how to compile this code in VB5 after I have modify the
> > code?
> > > > Any more help in this would be appreciated.... Hopefully what I
> > described
> > > > above is all the work involved in making this work.
> > >
> > > the sample was written in VB6 and I don't know if the project files of
> the
> > > sample are compatible with VB5.
> > >
> > > I never used VB5 but in VB6 it's very simple to compile the project:
> Open
> > > it, make your changes and then select File->Make <ProjectName>" and
> choose
> > > the destination path for the DLL to create.
> > >
> > > Franz
> > >
> > >
> > >
> > >
> > > "John Smith" <mayabuttreek123@lycos.com> wrote in message
> > > news:wxGBquzfDHA.2640@is1.netal.com...
> > > > Hi Franz,
> > > >
> > > > After reading the sample VB code in the SDK, it looks like I don't
> have
> > to
> > > > edit "SL4NTCRCVB.vbp" and "SL4NTCRCVB.vbw" since I could use it as
is.
> > > >
> > > > As far as the "CustomRuleCondition.cls", there is not much editing
> > unless
> > > I
> > > > change the function name and/or return type to something else. But
if
> I
> > > keep
> > > > the function name and return type as is, I can use this sample
> > > > "CustomRuleCondition.cls" as is also.
> > > >
> > > > So the only real work is in the "HelperFunctions.bas" file which
> > contains
> > > > the algorithm for the function called in the
"CustomRuleCondition.cls"
> > > file.
> > > >
> > > > So I modify the function in "HelperFunctions.bas" to perform the
space
> > > > delimited parsing and rename the function name. The individual space
> > > > delimited value that is parsed would be returned in the function
> > parameter
> > > > variable and written to one of the sixteen custom columns in
> > > > "CustomRuleCondition.cls". In "CustomRuleCondition.cls", I would
> change
> > > the
> > > > function name to the name I specify in the "HelperFunctions.bas"
file.
> > > That
> > > > is it, I think...
> > > >
> > > > I never compiled an ActiveX component before. Would you be able to
> > provide
> > > > some help in how to compile this code in VB5 after I have modify the
> > code?
> > > > Any more help in this would be appreciated.... Hopefully what I
> > described
> > > > above is all the work involved in making this work.
> > > >
> > > > Thanks,
> > > > John
> > > >
> > > >
> > > > "John Smith" <apu000a@hotmail.com> wrote in message
> > > > news:$Pwun%23rfDHA.1924@is1.netal.com...
> > > > > Franz,
> > > > >
> > > > > Thanks for the responses. Right now we are either going with Run
> > Program
> > > > > (program would be Java applet using JDBC) OR the Custom Evaluator.
I
> > am
> > > > very
> > > > > rusty in my C++ and VB so I am asking one of the developers in my
> > > company
> > > > to
> > > > > help me. I need to speak with him on which approach he is
> comfortable
> > > with
> > > > > (he knows both java and C++ but java better).
> > > > > I guess I should take a look at the sample source and see if it is
> > > > > sufficiently complete for me or my developer to modify to meet our
> > needs
> > > > > without extensive work.
> > > > > If we decide to go with the custom evaluator and run into a
problem,
> > we
> > > > will
> > > > > definitely contact you for help...
> > > > >
> > > > > Thanks,
> > > > > John
> > > > >
> > > > > "Franz Krainer" <franzk@netal.com> wrote in message
> > > > > news:u7ON5pseDHA.3388@is1.netal.com...
> > > > > > > One thing I was thinking of was using the Custom Evaluator.
One
> > > thoght
> > > > > was
> > > > > > > to use the Custom Evaluator and somehow have it read the
content
> > of
> > > > the
> > > > > > > MessageText column as it comes in and have it directly write
> each
> > > > space
> > > > > > > separated value to its own column in the SQL table. Is this
> > > possible?
> > > > > >
> > > > > > Yes, that's the way to go:
> > > > > >
> > > > > > Implement a custom evaluator object that takes the message text,
> > > > extracts
> > > > > > the data to be separated and stores them in the (up to 16)
> available
> > > > > custom
> > > > > > fields. Then configure your "Log to ODBC" action to map the used
> > > custom
> > > > > > fields to your table columns.
> > > > > >
> > > > > >
> > > > > > > Another possibility was using the Custom Evaluator to reformat
> the
> > > > > > incoming
> > > > > > > syslog messages so that each of the MessageText space
separated
> > > values
> > > > > > > becomes a comma separated value and I can then maybe use the
> > Custom
> > > > > > Mapping
> > > > > > > feature in Log to ODBC to map each of these "new" comma
separate
> > > > values
> > > > > > into
> > > > > > > the SQL DB. I don't know if this is possible.
> > > > > >
> > > > > > This won't work.
> > > > > >
> > > > > > > Can I use the "Run a program" option to parse the incoming
> syslog
> > > > > message,
> > > > > > > ie similar to a "pipe" command?
> > > > > >
> > > > > > You could use a "Run a program" action to parse the message text
> > into
> > > > the
> > > > > > desired parts but there are two big problems with this approach:
> > > > > >
> > > > > > 1. Very slow
> > > > > > 2. The program called must then take care of logging the data to
> the
> > > DB.
> > > > > >
> > > > > > I can only recommend to implement a custom evaluator object.
This
> > > > approach
> > > > > > is perfectly suited for your requirements (verfy fast & minimal
> > > resource
> > > > > > usage).
> > > > > >
> > > > > > Should you need help in implementing such a custom evaluator
> object,
> > > > > please
> > > > > > contact me.
> > > > > >
> > > > > > Franz
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>