Formats
There are two kind of formats which are described in the upcoming paragraphs. These are:
- Database Format and,
- XML Format
Database Format - WinSyslog 5.x stores and expects data in the “MonitorWare
Common Database Format”. This format is understood by all members of the
MonitorWare line of products.
The database format is easy to implement and does not rely on
database-specific features. All event data is stored in a single table.
There are some large textual elements inside that table, namely the message
part and the Windows event log binary data part. These entities should be stored
as a large text element whenever the database system supports it. For example,
under Microsoft SQL Server this is the “text” data type.
Adiscon officially support Microsoft Jet, SQL Server and MySQL databases. However,
all MonitorWare products work with a large variety of databases, including for
example Oracle or Sybase. As long as there is a standard ODBC driver available
for a given database, it should be usable with MonitorWare line of products.
The default table name as well as all field (column) names can be overwritten
with the configuration client. This is most useful if the data is to be included
into an already existing database or to solve reserved-name conflicts with not
directly supported systems. For example, this needs to be done with Sybase as
“message” is a reserved word there. For ease of use, we recommend not to change
any of the default names if there is no definite need to do so.
There are samples available for Microsoft Jet (Access), Microsoft SQL
Server and MySQL.
XML Format - The following XML tags are used by WinSyslog:
| Tag Name |
Content Description |
| iut |
This is the InfoUnitType. This uniquely identifies the type of
event. This is an integer value. |
| severity |
The NT Event Log severity. |
| source |
The computer the event originates from. It can be either an IP
address or a computer name,depending on the reporting service and
its configuration. If it is a name, it can similarly be either the
name the system knows itself of, a name taken from a configuration
database (like reverse DNS lookup) or an name overridden by an rule. |
| Msg |
This is the message text that comes with the event. For example,
with Windows event log reports it is the message logged in the event log
while with syslog messages it is the actual message text. |
|
