By "default", you mean no Event ID/Event Category parsing is occurring at all? That doesn't sound right - autodetection should not happen in that case. In the initial release of 7.3.2 there was a problem where if you had overridden at least one standard property (not a custom property, it would need to be Username, Source IP, Dest IP, Log Source Time, etc) but had not overridden Event ID, then in teh generated Log Source Extension behind-the-scenes, the Event ID regex would be set to (.*) which would mean *any* event would be a match. This lead to false positive autodetection, where the log source type with that override would detect for any events it saw. That has since been fixed in patch 2 or 3 and sounds liek it migth be what you're seeing, except you mentioned that you'd only configured one custom property, and custom properties wouldn't have that effect. Are you certain it was a custom property and no standard fields had been configured?
Cheers
Colin
------------------------------
COLIN HAY
------------------------------
Original Message:
Sent: Fri November 29, 2019 04:44 AM
From: Thomas Hofer
Subject: Log Source Autodetection Configuration
Hi Colin,
no, the EventID/Category was default, but I have created one custom property and this log source type was autodetected.
Thomas
------------------------------
Thomas Hofer
------------------------------
Original Message:
Sent: Thu November 28, 2019 11:15 AM
From: COLIN HAY
Subject: Log Source Autodetection Configuration
Interesting. It may be that custom types behave a little differently. Still, the fact that the Event ID and Event Category properties must be set should hold true, those are the key properties for an event to be considered "recognized" by the DSM/log source type. Am I correct in assuming that any types you created which showed autodetection did have Event ID defined?
Cheers
Colin
------------------------------
COLIN HAY
Original Message:
Sent: Thu November 28, 2019 10:43 AM
From: Thomas Hofer
Subject: Log Source Autodetection Configuration
Hi Colin,
many thanks for this answer. But this means that I wouldn't get any successful Log Source Type Autodetection if I have not defined any mappings in my new created Log Source Type. However, I was able to autodetect some log sources without configured mapping ( besides the default store/unknown).
Thomas
------------------------------
Thomas Hofer
Original Message:
Sent: Wed November 27, 2019 01:19 PM
From: COLIN HAY
Subject: Log Source Autodetection Configuration
Hi Thomas,
The autodetection engine tracks number of successful and failed parse attempts for events received which don't yet have a log source to be routed to. Once enough successful parses occur, autodetction of a new log source occurs.
A "successful parse" is when the Event ID and Event Category properties are set and match an existing Event Mapping/QID record. The other properties defined in the DSM Editor are not relevant from an autodetection standpoint.
Cheers
Colin
------------------------------
COLIN HAY