Some common error can be seen if there is issues with incoming XML files:
024-11-19T05:49:28.137075+00:00 hostname syslog-ng[3473166]: xml-parser failed; error='Error on line 1 char 3611: Odd character \'A\', expected an open quote mark after the equals sign when giving value for attribute \'Keyword\' of element \'Keywords\'', forward_invalid='1'
The incoming XML file was not formatted correctly to be used by the syslog-ng PE XML parser.
The XML files can be checked using the XMLLINT:
Sample command:
xmllint --format /_temp/wrong.xml.raw.msg
The common error can be seen by the command:
/_temp/wrong.xml.raw.msg:1: parser error : error parsing attribute name
KAGE_V1_0</PackageName><TargetUserName>svc-F5-Probe</TargetUserName><Workstation
^
/_temp/wrong.xml.raw.msg:1: parser error : Couldn't find end of Start Tag Data line 1
argetUserName>svc-F5-Probe</TargetUserName><Workstation'/><Data Name='Status>0x0
/_temp/wrong.xml.raw.msg:1: parser error : Opening and ending tag mismatch: Event line 1 and Workstation
>svc-F5-Probe</TargetUserName><Workstation'/><Data Name='Status>0x0</Workstation
/_temp/wrong.xml.raw.msg:1: parser error : Extra content at the end of the document
>svc-F5-Probe</TargetUserName><Workstation'/><Data Name='Status>0x0</Workstation
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center