Adding a Log Source Extension
You can add a log source extension to extend or modify the parsing routines of specific devices.
- Click the Admin tab.
- Click the Log Source Extensions icon.
- Click Add.
- From the Log Source Types list, select one
of the following options:
Select this option when the device support module (DSM) correctly parses most fields for the log source. The incorrectly parsed field values are enhanced with the new XML values.
Set to default for
Select log sources to add or remove from the extension parsing. You can add or remove extensions from a log source.
When a log source extension is Set to default for a log source, new log sources of the same Log Source Type use the assigned log source extension.
- Click Browse to locate your log source extension XML document.
- Click Upload. The contents of the log source extension is displayed to ensure that the proper extension file is uploaded. The extension file is evaluated against the XSD for errors when the file is uploaded.
- Click Save.
If the extension file does not contain any errors, the new log source extension is created and enabled. It is possible to upload a log source extension without applying the extension to a log source. Any change to the status of an extension is applied immediately and managed hosts or Consoles enforce the new event parsing parameters in the log source extension.
On the Log Activity tab, verify that the parsing patterns for events is applied correctly. If the log source categorizes events as Stored, the parsing pattern in the log source extension requires adjustment. You can review the extension file against log source events to locate any event parsing issues.