RSA Admin

ESI EventTime with two fields

Discussion created by RSA Admin Employee on Apr 26, 2010

I'm using the ESI tool and I have a problem to add an Event Source Time Stamp (EVNTTIME) variable in the end of the message. I'm trying to create this variable with two diferent char fields (date and time) but I can't.

I got this error message "You have selected an invalid time stamp. Select a valid time stamp in the event to proceed."

Do I have to define those fields as variables?


Below are my header and message code:


  content="%&lt;msgIDPart1&gt;: &lt;hdata&gt;;&lt;hzone&gt; ;&lt;msgIDPart2&gt; &lt;!payload:$START&gt;"/>


  content="%TOTVS_PROTEUS_AUDIT: &lt;trans_id&gt;;&lt;sessionid&gt;;&lt;entry&gt;;&lt;index&gt;;&lt;username&gt;;&lt;node&gt;;&lt;statement&gt;;&lt;uhost&gt;;&lt;handle_id&gt;;&lt;privilege&gt;;&lt;db_pid&gt;;&lt;pread&gt;;&lt;host&gt;;&lt;filename&gt;;&lt;binary&gt;;&lt;event_type&gt;;&lt;db_name&gt;;&lt;os&gt;;&lt;process_id&gt;;&lt;obj_type&gt;"/>


What I'm trying to do is something similar to the code below made with the previous tool (UDS.exe)


content="&lt;@datetime:*EVNTTIME($MSG,'%W%M%D %H:%T:%S',event_user,event_source)