RSA Admin

ESI EventTime with two fields

Discussion created by RSA Admin Employee on Apr 26, 2010

I'm using the ESI tool and I have a problem to add an Event Source Time Stamp (EVNTTIME) variable in the end of the message. I'm trying to create this variable with two diferent char fields (date and time) but I can't.

I got this error message "You have selected an invalid time stamp. Select a valid time stamp in the event to proceed."

Do I have to define those fields as variables?

 

Below are my header and message code:

 

<HEADER
  id1="0001"
  id2="0001"
  messageid="STRCAT(msgIDPart1,&apos;_&apos;,msgIDPart2)"
  content="%&lt;msgIDPart1&gt;: &lt;hdata&gt;;&lt;hzone&gt; ;&lt;msgIDPart2&gt; &lt;!payload:$START&gt;"/>

 

 <MESSAGE
  level="4"
  parse="1"
  parsedefvalue="1"
  tableid="59"
  id1="TOTVS_PROTEUS_AUDIT:ACCESS"
  id2="TOTVS_PROTEUS_AUDIT_ACCESS"
  eventcategory="1304000000"
  content="%TOTVS_PROTEUS_AUDIT: &lt;trans_id&gt;;&lt;sessionid&gt;;&lt;entry&gt;;&lt;index&gt;;&lt;username&gt;;&lt;node&gt;;&lt;statement&gt;;&lt;uhost&gt;;&lt;handle_id&gt;;&lt;privilege&gt;;&lt;db_pid&gt;;&lt;pread&gt;;&lt;host&gt;;&lt;filename&gt;;&lt;binary&gt;;&lt;event_type&gt;;&lt;db_name&gt;;&lt;os&gt;;&lt;process_id&gt;;&lt;obj_type&gt;"/>

 

What I'm trying to do is something similar to the code below made with the previous tool (UDS.exe)

 

content="&lt;@datetime:*EVNTTIME($MSG,'%W%M%D %H:%T:%S',event_user,event_source)

 

Thanks

Pedro

 

Outcomes