Kaspersky Unified Monitoring and Analysis Platform

Connector, 1c-xml type

Expand all | Collapse all

Connectors of the 1c-xml type are used for getting data from 1C registration logs when working with Linux agents. When the connector handles multi-line events, it converts them into single-line events.

If while creating the collector at the Transport step of the installation wizard, you specified a connector of the 1c-xml type, at the Event parsing in the Mapping table, you can pass the name of the file being processed by the collector or the path to the file in the KUMA event field. To do this, in the Source column, specify one of the following values:

• $kuma_fileSourceName to pass the name of the file being processed by the collector in the KUMA event field.
• $kuma_fileSourcePath to pass the path to the file being processed by the collector in the KUMA event field.

When you use a 1c-xml connector, the new variables in the normalizer will only work with destinations of the internal type.

Settings for a connector of the 1c-xml type are described in the following tables.

Basic settings tab

Advanced settings tab

Connector operation diagram:

1. The files containing 1C logs with the XML extension are searched within the specified directory. Logs are placed in the directory either manually or using an application written in the 1C language, for example, using the ВыгрузитьЖурналРегистрации() function. The connector only supports logs received this way. For more information on how to obtain 1C logs, see the official 1C documentation.
2. Files are sorted by the last modification time in ascending order. All the files modified before the last read are discarded.

   Information about processed files is stored in the file /<collector working directory>/1c_xml_connector/state.ini and has the following format: "offset=<number>\ndev=<number>\ninode=<number>".

3. Events are defined in each unread file.
4. Events from the file are processed one by one. Multi-line events are converted to single-line events.

Connector limitations:

• Installation of a collector with a 1c-xml connector is not supported in a Windows operating system. To set up transfer of 1C log files for processing by the KUMA collector:
  1. On the Windows server, grant read access over the network to the folder with the 1C log files.
  2. On the Linux server, mount the shared folder with the 1C log files on the Windows server (see the list of supported operating systems).
  3. On the Linux server, install the collector that you want to process 1C log files from the mounted shared folder.
• Files with an incorrect event format are not read. For example, if event tags in the file are in Russian, the collector does not read such events.

  Example of a correct XML file with an event.

  <?xml version="1.0" encoding="UTF-8"?>

  <v8e:EventLog xmlns: v8e="http://v8.1c.ru/eventLog"

  xmlns:xs="http://www.w3.org/2001/XMLSchema"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

  <v8e:Event>

  <v8e:Level>Information</v8e:Level>

  <v8e:Date>2022-12-07T01:55:44+03:00</v8e:Date>

  <v8eApplicationName>generator.go</v8e:ApplicationName>

  <v8e:ApplicationPresentation>generator.go</v8e:ApplicationPresentation>

  <v8e:Event>Test event type: Count test</v8e:Event>

  <v8e:EventPresentation></v8e:Event Presentation>

  <v8e:User>abcd_1234</v8e:User>

  <v8e:UserName>TestUser</v8e:UserName>

  <v8e:Computer>Test OC</v8e:Computer>

  <v8e:Metadata></v8e:Metadata>

  <v8e:MetadataPresentation></v8e:MetadataPresentation>

  <v8e:Comment></v8e:Comment>

  <v8e:Data>

  <v8e:Name></v8e:Name>

  <v8e:CurrentOSUser></v8e:CurrentOSUser>

  </v8e:Data>

  <v8e:DataPresentation></v8e:DataPresentation>

  <v8e:TransactionStatus>NotApplicable</v8e:TransactionStatus>

  <v8e:TransactionID></v8e:TransactionID>

  <v8e:Connection>0</v8e:Connection>

  <v8e:Session></v8e:Session>

  <v8e:ServerName>kuma-test</v8e:ServerName>

  <v8e:Port>80</v8e:Port>

  <v8e:SyncPort>0</v8e:SyncPort>

  </v8e:Event>

  </v8e:EventLog>

  Example of a processed event.

  

• If a file read by the connector is enriched with the new events and if this file is not the last file read in the directory, all events from the file are processed again.