Problem with Accents in the logs

[jagonzalez]

I currently have a NagiosLS v.1.4.4. with this version it works correctly the accents. The servers that are in Spanish and in the logs appear accents
Now, I am updating to the latest version of NagiosLS with the template nagioslogserver-2.0.2-64.ova ... And with the same configuration as in the previous version, they do not look correctly.

Attached screenshots with the same server when sending the logs to the 2 systems.

What could be the problem?

Regards and Thanks

[dwhitfield]

On both the remote server and the two NLS systems, what is the output of the following data (please use code blocks):

Code: Select all

cat /etc/locale.conf
locale

The language set in NLS....also, any other language settings you thinking may be useful.

We aren't able to reproduce what you are seeing. Did you (or someone else at your organization perhaps) work with our sales team at all to set up this NLS server? Also, is there a reason you are posting in general support rather than customer support?

[jagonzalez]

This is the result in the 2 servers when executing the command "locale"

LANG=es_ES.UTF-8
LC_CTYPE="es_ES.UTF-8"
LC_NUMERIC="es_ES.UTF-8"
LC_TIME="es_ES.UTF-8"
LC_COLLATE="es_ES.UTF-8"
LC_MONETARY="es_ES.UTF-8"
LC_MESSAGES="es_ES.UTF-8"
LC_PAPER="es_ES.UTF-8"
LC_NAME="es_ES.UTF-8"
LC_ADDRESS="es_ES.UTF-8"
LC_TELEPHONE="es_ES.UTF-8"
LC_MEASUREMENT="es_ES.UTF-8"
LC_IDENTIFICATION="es_ES.UTF-8"
LC_ALL=

In NLS with version 1.4.4 - Working Fine
In the new NLS with version 2.0.2 - error with accents

The problem is when you receive information from a server with OS with language in Spanish. It only fails with the version 2.0.2

[mcapra]

Double check the encoding used on your Windows machines and make sure it matches the encoding used in the eventlog input defined in Nagios Log Server. It probably looks something like this currently:

Code: Select all

tcp {
        type => 'eventlog'
        port => 3515
        codec => json {
            charset => 'CP1252'
        }
    }

The default Nagios Log Server eventlog input expects CP1252. Newer versions of Windows default to CP437. Your machines might be using something else entirely.

Also, specifically for flat-file logs you're capturing with nxlog, the encoding of the text file matters. ASCII, UTF-8, ISO-8859-1, etc.

[npolovenko]

Thanks, @mcapra.
@jagonzalez, On the old Log Server Server(that renders Spanish characters) please navigate to the Configure page and then Global Config.

Untitled.png

What charset is Windows Event Log using?
Then go to the same directory on a new log server and make sure it's the same.

Are you monitoring the same windows servers with both Log Servers? On the monitored server please run: chcp and show us the output.

[jagonzalez]

Thanks, npolovenko & mcapra.
In the 2 servers is the same configuration in "Global Configuration"

tcp {
type => 'eventlog'
port => 3515
codec => json {
charset => 'CP1252'
}
}

The server that I monitor is the same with both NLS. so I understand the problem is not in the nxlog service, nor in the monitored machine. (W2008 Server)

The result of executing chcp is "Página de códigos activa: 850"

[npolovenko]

@jagonzalez, Please change the global setting to:

Code: Select all

tcp {
type => 'eventlog'
port => 3515
codec => json {
charset => 'CP850'
}
}

Let us know if that fixes the issue.

Also, can you open the Event Viewer on the windows server, then click on windows logs and check to see if Spanish characters are rendered correctly over there?

[jagonzalez]

CP850.png

Hi,
I continue with the problem, after having changed the configuration in the global setting to: CP850. I have also tried with CP437.
with the same result. Now the symbol that shows instead of the accent is different

In the server windows logs, show correctly.

The weird thing is that the same windows server when I change from Nagios Log, to version 1.4.4. shows the accents correctly, just by changing the Ip in the nxlog configuration.

[npolovenko]

Hello, @jagonzalez. I'm waiting on the devs to give me some further recommendations. But so far I'm afraid I'll have to file a bug report for this issue.