Using the mmnormalize module in rsyslog is a bit complicated at first. We want to describe in this article how to set up the basic components for using log normalization. In addition to that we will show how to configure these components so messages will be split into pieces of information. These pieces of information should then be written into a database for review with Adiscon LogAnalyzer.

This guide has been tested with rsyslog v5.8.0 and liblognorm 0.3, libee 0.3.

The goal of this guide is to have a setup, that will have a message parsed by the normalizing tool, put some content of the message into specific properties. These properties will then be filled into a special database format, which will should be reviewed by Adiscon LogAnalyzer.

For using normalization we need the following:

• rsyslog
• liblognorm
• libee
• libestr

In the further process of the article we need additional elements:

• apache webserver with PHP5
• mysql database (usually with phpmyadmin)
• Adiscon LogAnalyzer

Step 1: Setting up rsyslog and log normalization

First of all we need to setup rsyslog for log normalization. So before installing rsyslog, we will install liblognorm, libee and libestr. They can be installed according to this guide. rsyslog can now be installed. We assume you have downloaded and extracted a tarball from the rsyslog download page. Change into the directory you installed rsyslog in. Now use the following commands to setup rsyslog correctly:

./configure --libdir=/lib --sbindir=/sbin --enable-mysql --enable-mmnormalize
make
make install

If everything is correct, the installation procedure should complete successfully. We can now start configuring rsyslog itself. We need a configuration that looks like this:

$ModLoad immark
$ModLoad imuxsock
$ModLoad imklog
$ModLoad mmnormalize
$ModLoad ommysql.so
$ModLoad imudp.so

$UDPServerRun 514

$mmnormalizeUseRawMSG 1
$mmnormalizeRuleBase /rsyslog/rulebase.rb
*.* :mmnormalize:

$template database,"insert into normalized (date, uhost, msgnumber, protocol, ipin, ipout, portin, portout)
values ('%$!date%', '%$!uhost%', '%$!msgnumber%', '%$!protocol%', '%$!ipin%', '%$!ipout%', '%$!portin%',
'%$!portout%')",SQL

*.*  mmysql:172.19.3.17,syslog, test, test;database

That is all for our rsyslog config. Looks pretty complicated right now. Basically, we load all necessary modules at the top. After that we start the UDP syslog server. It is needed to receive the messages. The next 3 lines are the parameters to initiate the normalization of messages. We declare, that the raw message should be used. Our rulebase for the normalization lies in the rsyslog directory (this path has to be changed if your directory lies somewhere else). And after that, we tell rsyslog to use normalization on all messages. The next line describes the template for the processed message. In the end, there should be a sql insert statement that puts all the parsed variables into their corresponding fields in the table “normalized”. The last line is finally the action that makes rsyslog write all messages (the ones created by the template – the sql statement – into a remote database.

After the configuration, we still need to setup a rulebase. This is done in a separate file. For our example, the rulebase should be the following file: /rsyslog/rulebase.rb

The file should look like this:

rule=:%date:date-rfc3164% %uhost:word% %tag:word%  %notused:chat-to:x3a%: %msgnumber:char-to:x3a%: access-list
inside_access_in permitted %protocol:word% inside/%ipin:ipv4%(portin:number%) ->
outside/%ipout:ipv4%(portout:number%) %notused2:char-to:]%]

The rule is basically one line. It might be shown otherwise here due to restrictions of the webdesign. It is basically a format of a message. The different parameters of a rule are shown in a different guide. The rule we have here should resemble the following message:

May 16 07:23:09 BHG-FW : %ASA-4-106100: access-list inside_access_in  permitted tcp inside/10.200.22.183(2969) ->
outside/67.192.232.82(80)  hit-cnt 1 first hit [0x48e9c345, 0x386bad81]

If you want to have multiple messages, where the format differs, you need multiple rules as well of course. The rules must be as precise as possible to resemble the message. If a message does not fit any listed rules, it will not be processed further. Something else that needs to be pointed out, is to keep the rules variable enough as well. Like in our example, there are some parts that will be the same for every message of this kind. Other parts might be with different content. And even if we do not need the content further, it should be put into a variable. Else the message might again not fit to the rule.

Step 2: Setting up the database

We suppose, that you already have a server with a database and webserver installed. The installation of the components has to be made according to the instructions given by the manufacturer of the software. Therefore we cannot give any examples for that.

But we need a specific database scheme for our example here. So we need to show this at least. As you have seen before, we have some specific parts of the message filled into properties. These properties should be written to the database. So here is the basic SQL statement to create the table according to our needs:

CREATE TABLE normalize
(
ID int unsigned not null auto_increment primary key,
date datetime NULL,
host varchar(255) NULL,
msgnumber varchar(20),
protocol varchar(60) NULL,
ipin varchar(60) NULL,
ipout varchar(60) NULL,
portin int NULL,
portout int NULL
)

You can execute this statement as you like. It is currently designed for a MySQL database, so you might need to change some bits if you are using a different database.

3. Using Adiscon LogAnalyzer with this database

Adiscon LogAnalyzer can be used to review the data from this database. Installation of Adiscon LogAnalyzer is shown here. Please note, that we will need the admin center. So please think of creating a user database when installing.

Point your browser to your Adiscon LogAnalyzer installation. Now we need to go to the admin center. There we have to set some parts to fit our custom format.

Edit Fields

First, we need to add some Fields. We need to do this, so we can use the custom fields in our database with LogAnalyzer. By default, the list of fields only reflects basically the MonitorWare Database Scheme. When clicking on Fields in the Admin Center, a list of the currently available fields will be shown:

By clicking on Add new Field, we can create a new Field.

We need to create 7 new fields only, though we have 8 custom fields in the table. Since date is the same, we can use the already formatted field. So we only need to create the fields for host, msgnumber, protocol, ipin, ipout, portin and portout.

Basically, the Field details should look like this:

To finally create the Field, click on the button “Add new Field”. Now the list should appear again with the newly created Field. Repeat this step for the other fieldnames as well.

Edit DBMappings

In conjunction with the Fields which are only for the internal use in Adiscon LogAnalyzer, we need to create a custom database mapping. Therefore go to DBMappings in the Admin Center. You will see a list of the currently available database mappings.

Click on Add new Database Mapping:

Here we need to tell Adiscon LogAnalyzer, which Field we created depends on which database field. Give your database mapping a name first. After that, choose the Fields we need from the dropdown menu and click on “Add Field Mapping into list”. The final step will be to enter the database field names into the list. It should now look like this now:

Finally click on “Add new Database Mapping”. This will save the mapping and get you back to the list of DBMappings.

Edit Views

The next step we need to adjust is the Views. In Views you can configure, what LogAnalyzer should show. This is related to the data that is stored in the database. Basically, a View should represent the kind of logs that are stored. For example if you use the View for Windows Event Logs, but have a database where Linux syslog is stored, many Fields will be shown as empty, because they are not filled like from Windows Event Logs. Therefore we need a custom view.

You will get there by clicking on Views in the Admin Center.

There are already pre-configured Views for Windows EventLog, Syslog and Webserver Logs. We need a completely different View though. A new View can be configured by clicking on “Add new View” at the bottom of the list.

You need to give your view a name. If you want, you can restrict the use of this view to certain users or groups, but we will skip that for now. The most important part is to select the Fields that should be displayed. This is done at “Configured Columns”. Before clicking on “Add new View” it should look like this:

After clicking the button, the new View should appear in our list.

Edit Sources

Finally, we need to create a Source. When installing Adiscon LogAnalyzer, you can already configure a Source. For our example, we need to create another Source. Therefore go to Sources in the Admin Center.

You will see a list of the configured Sources. It currently holds one Source. By clicking on Add new Source you can create another one.

Basically, we need to insert a Source Name. If you want, you can also create a description. Change the Source Type to MYSQL Native. You can also select a default View. Choose our lognorm View we created earlier. No more general options need to be set. If you want, you can again restrict the source to a user or group.

We still need to change the database Type options. As you can see, the fields have changed by setting the Source Type to MYSQL Native. As table type choose the lognorm type we created before. Insert the details as your database needs them. The complete form should look like this now:

Finish the new Source by clicking on Add new Source. It should now appear in the list.

Final Thoughts

Though this scenario seems very complex it shows in the end how easy some things can be afterwards. This setup shows exactly, how different products from the Adiscon product line can work together. And we have a good example for how normalizing works.

The usual user of Adiscon LogAnalyzer is using it on a Apache Webserver. But on the other hand, there are some customers who want to use it on IIS. Though, it is not ideally optimized for IIS, it still works. Unfortunately, the installation process is not entirely straight forward and installing PHP (which is a requirement) might give one or another a rather hard time. Now, fortunately, we found a very easy way to get things set up correctly, which we want to show.

Before we start, we have some information on the system we have used for this small article. We are working on a Windows Server 2008 R2 (x64). We have already installed IIS7.5 with the basic settings. Nothing more, nothing less.

1. Install PHP to work with IIS.

For Adiscon LogAnalyzer to work, we need to have PHP installed to IIS. Else, it will not work. The easiest way to have PHP installed is by going to the Microsoft Website and use the Web Platform Installer.

When visiting the website you need to install the Web Platform Installer first. Click on the green button to download it.

A download window for the PHP installer will open. Click on “Run” for now. If you want, you could also download the install file and run it manually later.

You will be now pointed to the setup for PHP. The current version is 5.3.6. Click on “Install”.

A list of the to be installed components will be shown. Click on “Accept”. The installer will show the progress now and do everything automatically.

Finally after PHP has been installed you will see this screen. Click on “Finish”, then “Exit” the Web Installer.

Basically we have now installed PHP. If everything went well, it should directly work with your IIS Webserver now.

2. Installing Adiscon LogAnalyzer

Before starting the installation of Adiscon LogAnalyzer, we need to do one more thing. For Adiscon LogAnalyzer to work, we need a file called config.php to be in the folder where the files for LogAnalyzer will be located. The default path for the files in IIS would be something like

C:\inetpub\wwwroot

If you have configured IIS to store the web data somewhere else, just navigate to that folder.

Now create a file called config.php. As a specialty, the file needs to be writable. So go to the files properties and switch to the “Security” Tab. Edit the permissions so the group “Everyone” has the permission to write and edit the file as well as read it. This could look somewhat like this:

Basically, that’s it. Close the properties window and go back to the web folder. You can now copy the contents of the SRC folder from the LogAnalyzer tarball to this folder. Point your browser to localhost. You can now install Adiscon LogAnalyzer.

For more information about the installation process, please visit this guide.

How to setup EventReporter to view Windows Eventlogs in Adiscon LogAnalyzer.

Article created 2009-08-11 by Andre Lorbach.

Last edited 2011-09-01 by Florian Riedl.

This article will help you to setup an environment to log and store Windows Events at a central place using EventReporter, and view and search them using Adiscon LogAnalyzer.

You can
download a preconfigured configuration from this link and import that into your own system. The configuration sample contains comments for better understanding. EventReporter Client can import the XML/REG configuration file via the “Computer Menu”.

Table of Contents

1. Requirements

1.1 About the requirements

1.2 Installing and configuring WAMP

1.3 Installing MYSQL ODBC Connector

2. Installing and configuring EventReporter

2.1 Download and Install EventReporter

2.2 Setup Processing RuleSet

2.2.1 Setup Database Logging

2.2.2 Create the Database Action in EventReporter

2.3.1 Setup File Logging

2.4 Add EventLog Monitor Service(s)

2.5 Starting EventReporter and verifying the configuration

3. Install and Setup LogAnalyzer

3.1 Download and copy LogAnalyzer to the right location

3.2 Install and configure LogAnalyzer

Final Thoughts

1. Requirements

1.1 About the requirements

Back to Top

1.2 Installing and configuring WAMP

After you downloaded WAMP, start the installation and follow the instructions. Make sure you do not have a web server or MYSQL Server already installed because this could result in conflicts. Most often Microsoft ISS is already installed on the Windows platform. If so, there is no need to install WAMP, butyou still need MySQL and php for IIS. This is described in another guide. I will use the default installation location in this article which is C:\wamp.

Back to Top

Once the Installation is finished, a new Icon appears in Windows Icon tray. Click it, and choose “Localhost” from the menu to verify if the installation was performed successfully. If it was, you should see a web site looking like the one on the right. To check if your MYSQL is running, click on the phpMyAdmin Menu button in the WAMP Menu, and login with the username “root” and no password – if you are asked for a login.

Back to Top

1.3 Installing MYSQL ODBC Connector

If you intend to store messages in MYSQL database, you need to install the MYSQL ODBC Connector. Otherwise you can skip this step. EventReporter will need a MYSQL ODBC driver in a later step in order to write into the MYSQL database. These drivers have to be downloaded and installed separately from here: http://dev.mysql.com/downloads/connector If your Windows System is a x64 version, it is important to install the x64 Version of the MySQL Connector driver. As the EventReporter Service runs as a 64bit application itself, it will need the connector to be 64bit as well.

2. Installing and configuring EventReporter

2.1 Download and Install EventReporter

2.2 Setup Processing RuleSet

2.2.1Setup Database Logging

If you want to store messages inside MYSQL, follow this step. Click on your WAMP Icon, and open the phpMyAdmin. Now Create a new database called “eventreporter“.

Back to Top

Once done, select the newly created database, switch to the “SQL” tab and copy the SQL statements from the textbox below. CREATE TABLE SystemEvents { ID int unsigned not null auto_increment primary key, CustomerID bigint, ReceivedAt datetime NULL, DeviceReportedTime datetime NULL, Facility smallint NULL, Priority smallint NULL, FromHost varchar(60) NULL, Message text, NTSeverity int NULL, Importance int NULL, EventSource varchar(60), EventUser varchar(60) NULL, EventCategory int NULL, EventID int NULL, EventBinaryData text NULL, MaxAvailable int NULL, CurrUsage int NULL, MinUsage int NULL, MaxUsage int NULL, InfoUnitID int NULL, SysLogTag varchar(60), EventLogType varchar(60), GenericFileName VarChar(60), SystemID int NULL }; CREATE TABLE SystemEventsProperties { ID int unsigned not null auto_increment primary key, SystemEventID int NULL, ParamName varchar(255) NULL, ParamValue text NULL }; Now insert the copied commands into the SQL field. Then Click “GO”, you should see “Your SQL query has been executed successfully” after that as well as two new tables on the left list called systemevents and systemeventsproperties.

Back to Top

2.2.2 Create the Database Action in EventReporter

Get back to the EventReporter Client and create a new Rule in your self-created RuleSet called “Database”. Then add a new “Write to Database” Action, and name it “MYSQL ODBC”. After creating this action, you should automatically be taken to the actions properties. Click on the “Data Sources (ODBC)” button to open the System ODBC Administrator. Click on the “System DSN” Tab and add a new Datasource, select “MySQL ODBC 5.1 Driver” as driver. It is important to add a System DSN rather then a User DSN, because User DSN’s are not usable by the EventReporter Service (this is a Windows design restriction). Name the new datasource “eventreporter” and use “localhost” as Server, “root” as username and no password. Then you are able to select the database which we created before called “eventreporter“.

Back to Top

Check the database logging action again, it should look like the one in the screenshot.

Back to Top

2.3.1Setup File Logging

If you want to consolidate your Windows Events in one large logfile, proceed with this step. Otherwise you can skip this step. Create a new rule called “File Logging” and add a “Write to File” Action. Select Custom Line Format, use the following (use copy&paste to enter it): %timegenerated:1:10%,%timegenerated:12:19%,%timegenerated:1:10%,%timegenerated:12:19%,%source%,%syslogfacility%,%syslogpriority%,EvntSlog: %id%,%user%,%sourceproc%,%NTEventLogType%,%severity%,%category%,%msg%%$CRLF%

Back to Top

Back to Top

2.4 Add EventLog Monitor Service(s)

Now add a Eventlog Monitor service. Inside that service, configure the logs to be monitored. For example you could only monitor the system or the security log. Just set the check markers as you like. It may also be a good idea to set a syslog tag name that matches the log (or the function of the machine name, e.g. “server_1″). By doing so, you can easily filter inside LogAnalyzer.

Back to Top

Back to Top

2.5 Starting EventReporter and verifying the configuration

From the EventReporter configuration point of view, everything is setup now. So kindly start the EventReporter Service and wait a few moments, so that the data can be processed. If you are using file logging, you should see that the logs folder on C:\ has been created and contains a WebServer.log file. If not, something went wrong. In this case please check the Windows Application EventLog for possible error reports from EventReporter.

Back to Top

If you are logging into a database, switch back to phpMyAdmin and browse through the systemevents table. You should see at least one data record in this table now, like in the screenshot sample. If not, something went wrong, in this case please check the Windows Application Event Log for possible error reports from EventReporter.

Back to Top

3. Install and Setup LogAnalyzer

3.1 Download and copy LogAnalyzer to the right location

If you are using MonitorWare Agent 6.0 or higher, a proper version of LogAnalyzer can be found in the MonitorWare Agent installation folder. If you are using an older Version of MonitorWare Agent or EventReporter, I recommend to download the latest stable or beta build from here: http://loganalyzer.adiscon.com/downloads In this article I will use LogAnalyzer Version 3.2.1. To unpack the install set, you need a program capable of processing tar.gz files. Most ZIP programs support this. If you do not have one, you can find WinRAR by following the link (we have no affiliation with the makers of WinRAR, but have found it to be a useful tool – use at your own risk). Open windows explorer and go to the www folder of your Apache web server, which is the folder where you can place html/php files. By default this will be “C:\wamp\www” if you have installed WAMP into the default installation folder. Create a new folder called LogAnalyzer there. If you downloaded and unpacked LogAnalyzer, and copy or move the content of the src folder into the C:\wamp\www\loganalyzer folder. If you have MonitorWare 6.0 or higher, you can use and copy the contents of the LogAnalyzer folder of your MonitorWare installation. The explorer window should look like in the screenshot now.

Back to Top

3.2 Install and configure LogAnalyzer

Open this link to start the LogAnalyzer installation: http://localhost/loganalyzer/ If you do not see a page like in the screenshot, something went wrong in the steps before, please check them in this case. Otherwise click on the text-link “here” on LogAnalyzer’s error page to start its installation routine.

Back to Top

Follow the installation steps of LogAnalyzer. I recommend to “Enable User Database” in Step 3, as this will give you an advanced admin control panel. The User Database requires a MYSQL database to work, you can use the same one as you are using for EventReporter.

Back to Top

If you are using MYSQL to store log messages and you have reached Step 7, switch the source type to “MYSQL Native” and name the Source “EventReporter” Use “eventreporter” as Database Name and “root” as Database User. Leave the other configuration variables as they are, see the screenshot for how it should look like. Then click on the Next button to finish the installation.

After you finished the Installation of LogAnalyzer, you need to login and switch to the sources admin and configure the source “WebLogStore DB” there. - In field “Message Parsers” add apache2 if you are using combined log format. Add apach2common if you are using common log format.

Back to Top

If you are using file logging and you have reached Strep 7, switch the source type to “Diskfile” and name the Source “WebLogStore FILE” Use “C:/logs/WebServer.log” as syslog file. Leave the other configuration variables as they are, see the screenshot for how it should look like. Then click on the Next button to finish the installation.

After you finished the Installation of LogAnalyzer, you need to login and switch to the sources admin and configure the source “WebLogStore FILE” there. - In field “Message Parsers” add “eventlog” which is the required message parser to split the eventlog files correctly.

Back to Top

After clicking on the “Finish” link, you should see a working LogAnalyzer installation. If you do not see any data, there may be no data in your database yet. Otherwise you will see an error code and message from LogAnalyzer.

Back to Top

Final Thoughts

I hope this article will help you installing and configuring Loganalyzer and EventReporter. If you have problems or question related to this article, don’t hesitate to contact me or our support by email.

Please note that while this setup works, it is not very secure. At a minimum, it is recommended to set proper passwords for the databases (instead of using a password-less root account). Please review the relevant documentation on how to do that.

Download file name: LogAnalyzer 3.2.2 (v3-stable)

Changes:

• Implemented support to use User or Group configured logstream sources in commandline report generator (cmdreportgen.php). The Report Admin will generate an additional parameter for the sample commandline: userid=$uid or groupid=$gid
• Fixed syntaxlogic bugs in proxy utilisation, thanks to forum member Pierre: http://kb.monitorware.com/post-t10570.html#p20033
• Fixed ignoring “IPAddressResolve” setting when “EnableContextLinks” was disabled.
• Added check in core function to automatically remove MagicQuotes (via “magic_quotes_gpc” setting).
• Added support to search for full phrases instead of words only. Kindly use Quotes to mark the start and end of a phrase, for example:
  “Search for this”     // Searches for full phrase
  -”Search for this”    // Excludes full phrase
• Report admin:
  • Fixed saving custom filterstring if new report was created or the previous custom filterstring was empty.
  • Fixed filter editor issues when full phrase strings (with spaces) were configured.
  • Fixed error in parsing include/exclude filters for numeric fields in report admin panel. Changes in the main filter parser were also necessary to fix this issue.
• Fixed filter detection bug in report class which could lead to problems with certain filter evaluations.

Version: 3.2.2

File size: 1,005 MB

Hi all,

We have just released LogAnalyzer 3.2.2. The new stable release has the following changes:

• Implemented support to use User or Group configured logstream sources in commandline report generator (cmdreportgen.php). The Report Admin will generate an additional parameter for the sample commandline: userid=$uid or groupid=$gid
• Fixed syntaxlogic bugs in proxy utilisation, thanks to forum member Pierre: http://kb.monitorware.com/post-t10570.html#p20033
• Fixed ignoring “IPAddressResolve” setting when “EnableContextLinks” was disabled.
• Added check in core function to automatically remove MagicQuotes (via “magic_quotes_gpc” setting).
• Added support to search for full phrases instead of words only. Kindly use Quotes to mark the start and end of a phrase, for example:
  “Search for this” // Searches for full phrase
  -”Search for this” // Excludes full phrase
• Report admin:
  • Fixed saving custom filterstring if new report was created or the previous custom filterstring was empty.
  • Fixed filter editor issues when full phrase strings (with spaces) were configured.
  • Fixed error in parsing include/exclude filters for numeric fields in report admin panel. Changes in the main filter parser were also necessary to fix this issue.
• Fixed filter detection bug in report class which could lead to problems with certain filter evaluations.

Download: http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-2-2

As always, feedback is appreciated.

Best regards,
Florian Riedl

We have just released LogAnalyzer 3.2.3. The new stable release has the following changes:

• Removed magic quotes check from database functions (obselete due the changes in the last version)

• Merged Changes from BUGID #288 (Thanks to User Jeff)

• Fixed internal Filter parsing bug introduced in 3.2.2.

• Fixed bug in syslog summary report missing checksum in report generation

• Fixed bug in preparing filters for display in basic report class

• Fixed bug in verification routine of sources admin when backslashes were in any other variables

• Fixed BUGID #291, custom filters are now taken care in database logstream sources when cleaning up data.

• Changed minwidth for context menus from 200 to 250px due display problems in some browsers.

Download: http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-2-3

As always, feedback is appreciated.

Best regards,
Tim Eifler

Download file name: LogAnalyzer 3.2.3 (v3-stable)

Changes:

• Removed magic quotes check from database functions (obselete due the changes in the last version)
• Merged Changes from BUGID #288 (Thanks to User Jeff)
• Fixed internal Filter parsing bug introduced in 3.2.2.
• Fixed bug in syslog summary report missing checksum in report generation
• Fixed bug in preparing filters for display in basic report class
• Fixed bug in verification routine of sources admin when backslashes were in any other variables
• Fixed BUGID #291, custom filters are now taken care in database logstream sources when cleaning up data.
• Changed minwidth for context menus from 200 to 250px due display problems in some browsers.

Version: 3.2.3

File size: 985.88672 KB

Download file name: LogAnalyzer v3.3.0 (beta)

Changes:

• New view for Reports in main area. The new view is simular to the statistics page and makes the report more aware and accessible to  loganalyzer users. The reports are still edited in the Admin Center.
• Syslog/Eventlog Summary Report – both reports have been upgraded to V2! The “Event Count” column has been moved to the left of the report. The reports are using  logstream functions now to generate the report data. This has a huge positive impact on performance of database logstream  sources. Checksum calculation needed to consolidate messages is now  done by the logstream source.
• Added function to generate missing checksums for all messages in  logstream reports. This means first time you generate a report could  take a little bit longer than usual.
• Added optimization check into logstream sources. This check is automatically performed by the report admin. If Fields, Indexes or Triggers are missing, the report admin will inform you and give you the possibility optimize the logstream source. These checks are supported for Mysql, PostgreSQL and MSSQL only. Loganalyzer will need ALTER TABLE rights in order to fix or optimize the database structure. Indexes added by the a Report will enhance generation time as the involved fields are used for grouping or sorting. Triggers are used to generate the message checksum when a new data record is INSERTED into the database.
• Added more debug output at critical areas.
• Fixed bug with filter edit handling in report admin
• Changed mininum width of context menu on mainpage from  200 to 250px due display problems in some browsers.

Version: 3.3.0
File size: 1027276 bytes

Hi all,

We have just released LogAnalyzer 3.3.0. The new release has the following changes:

• New view for Reports in main area. The new view is simular to the statistics page and makes the report more aware and accessible to  loganalyzer users. The reports are still edited in the Admin Center.
• Syslog/Eventlog Summary Report – both reports have been upgraded to V2! The “Event Count” column has been moved to the left of the report. The reports are using  logstream functions now to generate the report data. This has a huge positive impact on performance of database logstream  sources. Checksum calculation needed to consolidate messages is now  done by the logstream source.
• Added function to generate missing checksums for all messages in  logstream reports. This means first time you generate a report could  take a little bit longer than usual.
• Added optimization check into logstream sources. This check is automatically performed by the report admin. If Fields, Indexes or Triggers are missing, the report admin will inform you and give you the possibility optimize the logstream source. These checks are supported for Mysql, PostgreSQL and MSSQL only. Loganalyzer will need ALTER TABLE rights in order to fix or optimize the database structure. Indexes added by the a Report will enhance generation time as the involved fields are used for grouping or sorting. Triggers are used to generate the message checksum when a new data record is INSERTED into the database.
• Added more debug output at critical areas.
• Fixed bug with filter edit handling in report admin
• Changed mininum width of context menu on mainpage from  200 to 250px due display problems in some browsers.

Download:
http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-3-0

As always, feedback is appreciated.

Florian Riedl

Adiscon’s open source log analysis frontend LogAnalyzer has grown with some exciting new features. Most importantly, report generation speed has been much increased. This was made possible via tighter integration of the report logic with the actual log source (database or file). As a result, all reports are generated in considerably less time and require far fewer system resources to complete. Along the same lines, Adiscon LogAnalyzer now offers suggestions for indexing database sources. If it finds room for improvement, new indexes are automatically suggested. This results in overall improved speed throughout the application.

Also, finally a long-due user interface improvement has been made: to access the reporting feature, users needed to access the admin panel. This was kind of well-hidden and cumbersome. In 3.3.0, reports are directly available from Adiscon LogAnalyzer’s main panel. With this change, some users may even discover the reporting feature for the first time. The screenshot below gives you a sneak preview of the new interface.

Best of all, the new version has brought some under-the-hood improvements that we will utilize in the future to generate some really exciting new reports. Stay tuned, there is much more to come…

And finally let me say that work with the LogAnalyzer team to improve integration into rsyslog and the Adiscon’s Windows logging components. We are trying very hard to provide an easy to use, integrated solution.

Italian language files. Working with LogAnalyzer 3.2.3

Author: Luigi Rosa
License: GPLv3
Known Compatible With: Version 3.2.3

Latest Development Activity: 2011-12-01
Download: http://loganalyzer.adiscon.com/files/translations/loganalyzer_lang_it_IT_3.2.3.zip

Portuguese language files. Working with LogAnalyzer 3.2.3

Author: Ricardo Maraschini
License: GPLv3
Known Compatible With: Version 3.2.3

Latest Development Activity: 2011-12-01
Download: http://loganalyzer.adiscon.com/files/translations/loganalyzer_lang_pt_BR_3.2.3.zip

Download file name: LogAnalyzer 3.4.0 (v3-stable)

Changes:

• Added initial version of a new free report for consolidating Windows Eventlog Logon / Logoff events
• PDO LogStream, the RowCount function is now only used with MYSQL, PGSQL and MSSQL. Other PDO Drivers may not return a useful value.
• Removed language files from source, can be found here from now on:

  http://loganalyzer.adiscon.com/translations

• Straighten out a couple of issues
• Doc: Redirected professional support options to proper page

Version: 3.4.0

File size: 1001.847 KB

We have just released LogAnalyzer 3.4.0. The new stable release has the following changes:

• Added initial version of a new free report for consolidating Windows Eventlog Logon / Logoff events
• PDO LogStream, the RowCount function is now only used with MYSQL, PGSQL and MSSQL. Other PDO  Drivers may not return a useful value.
• Removed language files from source, can be found here from now on: http://loganalyzer.adiscon.com/translations
• Straighten out a couple of issues
• Doc: Redirected professional support options to proper page

Download: http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-4-0

As always, feedback is appreciated.

Best regards,
Florian Riedl

Ukrainian language files. Working with LogAnalyzer 3.4.0

Author: Serge Yakimchuck
License: GPLv3
Known Compatible With: Version 3.4.0

Latest Development Activity: 2011-12-13
Download: loganalyzer_lang_uk_UA_3.4.0.zip

test

This Step-By-Step Guide describe how to Upgrade your LogAnalyzer Version.
In this example I use a local WAMP Server.

1. First download the latest stable or beta build from here: http://loganalyzer.adiscon.com/downloads

2. Unpack the install set.

3. Then open the unpacked LogAnalyzer folder and copy or move the content of the “src” folder into Server directory where LogAnalyzer is installed in my example it’s “C:\wamp\www\LogAnlyzer” and replace the old data.

4. Open your LogAnalyzer directory in the Web browser in my example it’s “http://localhost/loganalyzer/” on the screen look likes follow:

That was it.

Download file name: LogAnalyzer 3.4.1 (v3-stable)

Version 3.4.1 (stable), 2012-01-06

• Fixed a bug in Syslog and Eventlog summary report which consolidated wrong events when the source filter was used in the report.

File size: 1002.004 KB

We have just released LogAnalyzer 3.4.1. This stable release has the following changes:

• Fixed a bug in Syslog and Eventlog summary report which consolidated wrong events when the source filter was used in the report.

Download: http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-4-1

As always, feedback is appreciated.

Best regards,
Florian Riedl

Download file name: LogAnalyzer v3.5.0 (beta)

Changes:

• Added new Report “Eventlog Audit Summary Report” which can generate detailed security reports for Windows Eventlog security records. It supports Windows 2003 and 2008 Server and is compliant with the Sarbanes-Oxley (SOX) Act, 2002.
• Added support for customized boolean report filters. This enhancement is also used by the new “Eventlog Audit Summary Report”.

Version: 3.5.0
File size: 1018658 bytes