top of page

Syslog Interpreter

The window displays the patterns used by BusinessLog to identify Syslog messages to be recorded.

A pattern is a rule that identifies the message type and allows information to be extracted from it.

syslog interpreter.png

This form allows Syslog log acquisition from non-Windows devices to be configured and managed through the Syslog server integrated in BusinessLog.

The main functions are:

  • Activation of the Syslog server: routes Syslog messages to the IP address of the BusinessLog server.

  • Port configuration: allows you to specify the default port (UDP 514) or a custom port for receiving logs.

  • Log filtering: records only the syslogs related to specified administrator users, reducing log volume.

  • Advanced filters: Use of regular expressions (RegEx), which are rules for identifying and extracting information from messages, with the option to generate patterns through the guided procedure.

By clicking [Add], the following screen appears:

SYSLOG INGLESE 1.png

You can enter the desired strings in two ways:

  • Direct copy-paste from a string generated by the system log (Syslog)

  • Automatic selection using the [Open Collected Syslog Messages] button, which retrieves and inserts the available entries automatically.

Immagine3.png

When the window opens, the last 100 lines of the RegSysList.LOG file are automatically displayed.

Select a row and click [Select Syslog] to apply the entry:

SYSLOG INGLESE 2.png

The full message string is automatically reported in the "Syslog String" field.

The system sends the string contained in the Syslog String box to an artificial intelligence engine that analyzes its structure and automatically recognizes relevant patterns.

The purpose of the analysis is to identify the “style” of the Syslog message and map the main fields of interest, including:​

  • Device Identifier

  • Type Identifier

  • User

  • Origin

  • Event ID

  • Brand

  • Event Description

Recognition Check

After the automatic generation, the Recognition Check panel appears at the bottom of the window.

This panel shows the outcome of the analysis and points out any warnings, for example if the sample was recognized with alerts or if an equivalent pattern already exists.

The check helps the user decide whether to save the pattern, modify it, or regenerate it.

Required key fields

  • Device identifier: this must be present in text form within the Syslog message. It usually corresponds to the device name (devname), but it can also be a unique portion of text that allows the device to be identified without ambiguity.

  • Type identifier: defines the type of event, for example "login", "logout", "login failed", or "login successful". This value must also be present in the log string. To avoid ambiguity, generic or unclear terms should not be used. For example, if the text contains expressions such as "logon successfully" or "logon failed", it is preferable to specify a clear and explicit event type, such as "login successful" or "login failed", by manually adjusting the field if necessary.

When the analysis returns correct results, that is, with the fields highlighted in green, check for any messages in the Recognition Check box and click [Save] to save the new pattern. If you want to regenerate and check the pattern after modifying the fields, click [Regenerate Pattern].

SYSLOG INGLESE 2.png

The system, through an AI call, generates the regex and immediately verifies whether the data is extracted correctly.

  • If everything is correct, the fields turn green: at that point, simply click [Save].

  • In case of an error (for example an incorrect username), the box turns red, and the actual extracted value is shown below, compared with the expected one.

SYSLOG INGLESE 3.png

Once you click [Save], the pattern is added to the main list.

In this screen, each row displays:

  • Device

  • Type

  • []

  • Regex

  • Other pattern details

  • Locked status, which indicates whether the pattern is locked and therefore cannot be modified or deleted.

syslog interpreter 2.png

NOTE: If the icon is unlocked, the pattern can be freely edited and deleted.

Tools

bottom of page