Problem Using Mcafee Parser XML

Carlos,

I don't understand what you mean by "That's how it is. I measured it for testing."  The original parser and your parser are different on that line.  The original is sep=" and yours is sep=" ".  I suspect there is an issue with the interpretation of the new " you have added.  Can you post a sample of the log you are working with?  Also in the screenshot above, can you post it not showing the error box?  I'd like to see the color coding there to see if the line is formatted correctly.

Thanks,

Karn-------------------------------------------
Original Message:
Sent: Jul 19, 2021 09:08 AM
From: Carlos Maldonado
Subject: Problem Using Mcafee Parser XML

Greetings,

That's how it is. I measured it for testing.

I have been testing the parser but with the default configuration it throws an error.

Below I attach the default configuration:

9f5e10b5bac94539909f515b283f0492.png
when reforming the code, it throws the error indicated above.
Original Message:
Sent: Jul 08, 2021 04:19 PM
From: Karn Griffen
Subject: Problem Using Mcafee Parser XML

Carlos,

The original parser has this line:

<collectAndSetAttrByKeyValuePair sep=" src="$_body">

Your has:

<collectAndSetAttrByKeyValuePair sep=" " src="$_body">
Original Message:
Sent: Jul 02, 2021 12:39 PM
From: Carlos Maldonado
Subject: Problem Using Mcafee Parser XML

Greetings community.

Someone had an error modifying the McafeeXMLParser parser.

I have been doing several tests but it always gives me the error of:

Error on line 20 at column 35: Opening and ending tag mismatch: root line 0 and collectAndSetAttrByKeyValuePair.


######################​
<patternDefinitions>
<pattern name="patXml"><![CDATA[<EE_Event>.*</EE_Event>|<UpdateEvent>.*</UpdateEvent>|<EPOevent>.*</EPOevent>]]></pattern>
</patternDefinitions>
<eventFormatRecognizer><![CDATA[\s<:gPatHostName>\s+EPOEvents - .+?<:patXml>]]></eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex><![CDATA[<:gPatSyslogPRI>\d+\s+<_year:gPatYear>-<_mon:gPatMonNum>-<_day:gPatDay>T<_time:gPatTime>\.\d+<_tz:gPatTimeZone>\s+(?:<reptDevIpAddr:gPatIpAddr>|<reptDevName:gPatHostName>)\s+EPOEvents\s+.*?\<MachineInfo\><_body:gPatMesgBody>\</MachineInfo\>]]></regex>
</collectFieldsByRegex>
<setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_year, $_time, $_tz)</setEventAttribute>
<setEventAttribute attr="eventType">McAfee-EPO-Generic</setEventAttribute>
<collectAndSetAttrByKeyValuePair sep=" " src="$_body">
<attrKeyMap attr="machineGUID" key="1"/>
<attrKeyMap attr="version" key="2"/>
<attrKeyMap attr="_id" key="3"/>
<attrKeyMap attr="hostIpAddr" key="4"/>
<attrKeyMap attr="hostName" key="5"/>
<attrKeyMap attr="hostMACAddr" key="6"/>
<attrKeyMap attr="osName" key="7"/>
<attrKeyMap attr="user" key="8"/>
</collectAndSetAttrByKeyValuePair>
<when test="exist _id">
<setEventAttribute attr="eventType">combineMsgId("McAfee-EPO-", $_id)</setEventAttribute>
</when>
</parsingInstructions>

######################

as I observe the error is located in the yellow strip. But I see that the variables are closed and open correctly.

Did someone go through the same thing?