|
|
|
|
| Re: ATNA logging date parsing is broken [message #39771 is a reply to message #39679] |
Fri, 04 January 2008 17:24   |
Matthew Davis
Messages: 269
Registered: July 2009 |
Senior Member |
|
|
Hmmm..... well I know there were some wars last year pertaining to
formatting of ATNA syslog messages and I wasn't involved in most of
those battles. However, from RFC 3164 (BSD Syslog), the standard states:
"dd is the day of the month. If the day of the month is less than 10,
then it MUST be represented as a space and then the number. For
example, the 7th day of August would be represented as "Aug 7", with
two spaces between the "g" and the "7"."
So, space padding single-digit dates *should* be correct, unless DICOM
95 states otherwise (don't believe that's the case).
Should be noted that all of our ATNA logs we did for XDS MESA
verification were done on dates > 10 in December. :)
This may be a question for Bill Majurski.
Thanks,
-Matt
Sumedh wrote:
> This is the log I see pertaining to ATNA:
>
> DEBUG - Begin Document Retrieve.
> WARN - Defaulting to IP Address for AuditSourceID. This should be set
> by calling setAuditSourceId.
> DEBUG - Starting Audit start messages [1]
> DEBUG - Sending ActorStartStopMessage Audit message.
> INFO - <13>Jan 4 02:25:03 machine1 <?xml version="1.0"
> encoding="ASCII"?>.....
>
> Looks like the spacing is correct in my case as well, but the public
> NIST syslog server (http://129.6.24.109:9080/SyslogBrowser) is rejecting
> it with the following message:
>
> The syslog message should be formated like :
> <PRI> MMM DD HH:mm:ss ipAddress TAG:<?xml version="1.0"
> encoding="ASCII"?><AuditMessage> ... </AuditMessage>
>
> I feel a trailing 0 on single digit dates should resolve this.
>
> regards,
> Sumedh
>
|
|
|
|
| Re: ATNA logging date parsing is broken [message #584111 is a reply to message #39526] |
Thu, 03 January 2008 19:21 |
Matthew Davis
Messages: 269
Registered: July 2009 |
Senior Member |
|
|
Hi Sumedh, happy New Year to you too!
I just reran our audit tests again and the spacing is right on my tests:
<13>Jan 3 11:19:23 hostname <?xml version="1.0"
encoding="ASCII"?><AuditMessage xmlns:
xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="healthcare-security-audit.xsd ">
<EventIdentification EventActionCode="E"
EventDateTime="2008-01-03T11:19:23.583-08:00" EventOutcomeIndicator="0">
<EventID code="110112" codeSystemName="DCM" displayName="Query"/>
<EventTypeCode code="ITI-18" codeSystemName="IHE Transactions"
displayName="Registry Stored Query"/>
</EventIdentification>
// snip
</AuditMessage>
I wonder if this is an environment issue. What OS are you testing with
on this?
Thanks,
-Matt
Sumedh wrote:
> Hey Matt,
>
> Happy new year to you!
>
> OK here's another issue. Single digit date parsing is not in the "MMM DD
> HH:mm:ss" format. As soon as the year rolled over, the public ATNA
> syslog gave me "malformed xml" failure messages. The XDS.b stored query
> I fired executed perfectly. This is the date header on the xml:
>
> <13>Jan 3 13:21:42 machine1 <?xml version="1.0"
> encoding="ASCII"?><AuditMessage
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".....
>
> "Jan 3 13:21:42" is causing a problem here. As soon as I switched my
> system date to Jan 10, 2008 this worked perfectly. I'm not sure I can
> control this from the API exposed (can I?).
>
> This could be a blocker for me pretty soon. Please let me know if I
> should log this or its something you're already aware of and working on.
>
> Thanks.
>
> Regards,
> Sumedh
>
|
|
|
|
|
| Re: ATNA logging date parsing is broken [message #584187 is a reply to message #39679] |
Fri, 04 January 2008 17:24 |
Matthew Davis
Messages: 269
Registered: July 2009 |
Senior Member |
|
|
Hmmm..... well I know there were some wars last year pertaining to
formatting of ATNA syslog messages and I wasn't involved in most of
those battles. However, from RFC 3164 (BSD Syslog), the standard states:
"dd is the day of the month. If the day of the month is less than 10,
then it MUST be represented as a space and then the number. For
example, the 7th day of August would be represented as "Aug 7", with
two spaces between the "g" and the "7"."
So, space padding single-digit dates *should* be correct, unless DICOM
95 states otherwise (don't believe that's the case).
Should be noted that all of our ATNA logs we did for XDS MESA
verification were done on dates > 10 in December. :)
This may be a question for Bill Majurski.
Thanks,
-Matt
Sumedh wrote:
> This is the log I see pertaining to ATNA:
>
> DEBUG - Begin Document Retrieve.
> WARN - Defaulting to IP Address for AuditSourceID. This should be set
> by calling setAuditSourceId.
> DEBUG - Starting Audit start messages [1]
> DEBUG - Sending ActorStartStopMessage Audit message.
> INFO - <13>Jan 4 02:25:03 machine1 <?xml version="1.0"
> encoding="ASCII"?>.....
>
> Looks like the spacing is correct in my case as well, but the public
> NIST syslog server (http://129.6.24.109:9080/SyslogBrowser) is rejecting
> it with the following message:
>
> The syslog message should be formated like :
> <PRI> MMM DD HH:mm:ss ipAddress TAG:<?xml version="1.0"
> encoding="ASCII"?><AuditMessage> ... </AuditMessage>
>
> I feel a trailing 0 on single digit dates should resolve this.
>
> regards,
> Sumedh
>
|
|
|
|
Powered by
FUDForum. Page generated in 0.02433 seconds
] 
Search
Help
Register
Login
Home
