ESI tool modifying existing XML file

[RSAAdmin]

I am trying to use the new ESI tool modify an existing enVision XML supported devices for ciscopix and ciscoasa devices.  More specifically message IDs ???-6-604101, ???-6-604102, ???-6-604103, ???-6-604104.  Since these messages are already parsed correctly in each XML file, albeit, very generic.  I am looking to clone and convert the existing parsing statements to be secondary :01 message.  With that my plan is to more granularly parse the DHCP event messages into better variables that contain at least the MAC and IP address information and possibly the action.

It seems using the ESI I could not copy or clone an existing message nor could I select a sample record since all messages were parsed correctly in my sample file extracted via the lsdata command.  This seemed to limit what I could do.  Am I missing something.  Right now I am editing the XML outside of ESI to clone the eventIDs and do it the old way like UDS where you pick the fields.

[RSAAdmin]

You can try this...replace the payload on the message with exact text of one of the events:

So, take the DHCP message and replace the CONTENT=  for the message with something exact, like this:

DHCP daemon interface dmz3:  address granted 0100.1f29.d37d.7b

Then ESI shouldn't parse those messages.

Of course you copy the device XML and then cut out the original message and save it off.  You can put it back later after you finish.  That should work.

[RSAAdmin]

next version of ESI due in November will allow you to chage message ID also during clone.