There are two kind of formats which are described in the upcoming paragraphs. These are:
- Database Format and,
- XML Format
Database Format – WinSyslog 5.x stores and expects data in the “MonitorWare Common Database Format”. This format is understood by all members of the MonitorWare line of products.
The database format is easy to implement and does not rely on database-specific features. All event data is stored in a single table.
There are some large textual elements inside that table, namely the message part and the Windows event log binary data part. These entities should be stored as a large text element whenever the database system supports it. For example, under Microsoft SQL Server this is the “text” data type.
Adiscon officially support Microsoft Jet, SQL Server and MySQL databases. However, all MonitorWare products work with a large variety of databases, including for example Oracle or Sybase. As long as there is a standard ODBC driver available for a given database, it should be usable with MonitorWare line of products.
The default table name as well as all field (column) names can be overwritten with the configuration client. This is most useful if the data is to be included into an already existing database or to solve reserved-name conflicts with not directly supported systems. For example, this needs to be done with Sybase as “message” is a reserved word there. For ease of use, we recommend not to change any of the default names if there is no definite need to do so.
There are samples available for Microsoft Jet (Access), Microsoft SQL Server and MySQL.
- Database Samples
- XML Format
XML Format – The following XML tags are used by WinSyslog:
| Tag Name | Content Description |
| iut | This is the InfoUnitType. This uniquely identifies the type of event. This is an integer value. |
| severity | The NT Event Log severity. |
| source | The computer the event originates from. It can be either an IP address or a computer name,depending on the reporting service and its configuration. If it is a name, it can similarly be either the name the system knows itself of, a name taken from a configuration database (like reverse DNS lookup) or an name overridden by an rule. |
| Msg | This is the message text that comes with the event. For example, with Windows event log reports it is the message logged in the event log while with syslog messages it is the actual message text. |