We are using KIWI Syslog server v9.3. As a Log storage we use MS SQL 2005 Database. We have some problems with modifiers which is described below and I am interested if there is workaround for this.
In our infrastructure we store logs on the MS SQL Database and forward logs from KIWI Syslog server to the third party log collector. Third party performs parsing of and review of the logs.
We have enabled in the modifiers section:
Replace non printable characters with <ASCII value> and Remove CR/LF from the end of the massage
We enabled this options as Kiwi syslog collector was not able to record all the logs to the SQL database and there were too many errors in the Errorlog.txt. But after we enabled this option forwarded logs also are modified and our third party asks us to forward logs to them without any modification as in case when logs are modified they are not able to process them properly.
My question is - Is it possible to configure the system in the way that it did not make any changes to the logs that are forwarded and at the same time modify (Replace non printable characters with <ASCII value> and Remove CR/LF from the end of the massage) logs only when they are recorded to the local database? The best solution would be not to use Replace non printable characters with <ASCII value> function at all as <009> and others are very unfriendly when reading logs from the SQL database.
Thank you