6 Replies Latest reply on Aug 3, 2014 8:56 PM by hon

    Parser time period

    hon

      Dear all

      i have a sample log . If i set the time of the sample log to May, ERC could not parser these log. If i set the date to the current monyh [july], the parser work well

      In additon, if i turn off the aggregrate i can even see the log that the date is in May. I have attached the sample log with this post. I wanna know that is there any limit of time that erc could do a past parser . The time is in the field also wrong if i set to May

        • 1. Re: Parser time period
          rcavey

          hon,

           

            ERC parsers do *not* care about the specific date in a detected date field.  If I remember from a past adventure with this..... I uploaded my logs forgetting to adjust the date to the current day, the parser create the events but then I needed to adjust my date range to the actualy range in the logs in the main ESM GUI interface.

           

          Cheers,

            -B

          • 2. Re: Parser time period
            hon

            could you please try uploading my lo and adjust all the date to may. ESM cant parser the event [need to set all the log to may ]

            Please forgive me if i have no idea for this product, i am just a newby

            • 3. Re: Parser time period
              hon

              dear rcavey

              i think that it may invole of the date in the log because i have met the same prroblem with bluecoat log as attached file. If you dont change the date iEsm could not read this log

               

               

              2012-08-23 09:55:02 49896 10.188.0.5 - - - PROXIED "none" http://www.facebook.com/  200 TCP_NC_MISS_RST GET application/json http 0-143.channel.facebook.com 80 /pull ?channel=p_758080601&seq=15&partition=5&clientid=c3ec255&cb=kfp4&idle=86&mode=s tream&format=json - "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" 10.95.237.37 494 980 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/jpeg http www.dvdgameonline.com 80 /forums/uploads/av-41381.jpg - jpg "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 3355 1226 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/jpeg http www.dvdgameonline.com 80 /forums/uploads/profile/photo-thumb-107.jpg - jpg "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 3842 1241 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/jpeg http www.dvdgameonline.com 80 /forums/uploads/profile/photo-24020.jpg - jpg "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 13625 1237 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/png http www.dvdgameonline.com 80 /forums/uploads/profile/photo-thumb-16346.png - png "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 9114 1243 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/jpeg http www.dvdgameonline.com 80 /forums/uploads/profile/photo-thumb-45992.jpg - jpg "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 3816 1243 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/gif http www.dvdgameonline.com 80 /forums/uploads/profile/photo-thumb-41190.gif - gif "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 1476 1243 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/png http www.dvdgameonline.com 80 /forums/public/style_extra/sharelinks/facebook.png - png "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 639 1248 - "unavailable" "unavailable"

              2012-08-23 09:55:37 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/png http www.dvdgameonline.com 80 /forums/public/style_extra/sharelinks/twitter.png - png "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 826 1247 - "unavailable" "unavailable"

              2012-08-23 09:55:38 1 10.188.0.5 - - - PROXIED "none" http://www.dvdgameonline.com/forums/index.php?showtopic=312066&pid=3287022&st=0&  200 TCP_HIT GET image/gif http www.dvdgameonline.com 80 /forums/public/style_images/mobile/wait.gif - gif "Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; SonyEricssonX10a Build/3.0.1.G.0.75) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" 10.95.237.37 3460 1241 - "unavailable" "unavailable"

              2012-08-23 09:55:46 267 10.188.0.5 - - - PROXIED "none" http://www.facebook.com/  200 TCP_NC_MISS_RST POST application/x-javascript;%20charset=utf-8 http www.facebook.com 80 /ajax/presence/update.php - php "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" 10.95.237.37 472 1095 - "unavailable" "unavailable"

              2012-08-23 09:55:53 50201 10.188.0.5 - - - PROXIED "none" http://www.facebook.com/  200 TCP_NC_MISS_RST GET application/json http 0-143.channel.facebook.com 80 /pull ?channel=p_758080601&seq=15&partition=5&clientid=c3ec255&cb=j9v6&idle=137&mode= stream&format=json - "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" 10.95.237.37 494 981 - "unavailable" "unavailable"

              • 4. Re: Parser time period
                rcavey

                hon,

                 

                Sorry, I won't be uploading any external files into my systems.    Your logs are 2 years old.... just change the year, month and day to yesterday ( or last month ) and see what happens.  I don't remember seeing a drop down for "two years ago"  in the time listing but there is one for "last year"

                • 5. Re: Parser time period
                  hon

                  that is what i want to mean. I need to chang the date of the log to be recently . If the date is too long Esm cannot read it

                  • 6. Re: Parser time period
                    hon

                    i mean if the date is too old