Type 1c-xml

The 1c-xml type is used to retrieve data from 1C application registration logs. When the connector handles multi-line events, it converts them into single-line events. This type of connector is available for Linux Agents.

When creating this type of connector, specify values for the following settings:

• Basic settings tab:
  • Name (required)—a unique name for this type of resource. Must contain 1 to 128 Unicode characters.
  • Tenant (required)—name of the tenant that owns the resource.
  • Type (required)—connector type, 1c-xml.
  • URL (required)—full path to the directory containing files that you need to interact with. For example, /var/log/1c/logs/.

    Limitations when using prefixes in file paths

    Prefixes that cannot be used when specifying paths to files:

    • /*
    • /bin
    • /boot
    • /dev
    • /etc
    • /home
    • /lib
    • /lib64
    • /proc
    • /root
    • /run
    • /sys
    • /tmp
    • /usr/*
    • /usr/bin/
    • /usr/local/*
    • /usr/local/sbin/
    • /usr/local/bin/
    • /usr/sbin/
    • /usr/lib/
    • /usr/lib64/
    • /var/*
    • /var/lib/
    • /var/run/
    • /opt/kaspersky/kuma/

    Files are available at the following paths:

    • /opt/kaspersky/kuma/clickhouse/logs/
    • /opt/kaspersky/kuma/mongodb/log/
    • /opt/kaspersky/kuma/victoria-metrics/log/
  • Description—resource description: up to 4,000 Unicode characters.
• Advanced settings tab:
  • Character encoding setting specifies character encoding. The default value is UTF-8.
  • Debug—a toggle switch that lets you specify whether resource logging must be enabled. By default, this toggle switch is in the Disabled position.

Connector operation diagram:

1. The files containing 1C logs with the XML extension are searched within the specified directory. Logs are placed in the directory either manually or using an application written in the 1C language, for example, using the ВыгрузитьЖурналРегистрации() function. The connector only supports logs received this way. For more information on how to obtain 1C logs, see the official 1C documentation.
2. Files are sorted by the last modification time in ascending order. All the files modified before the last read are discarded.

   Information about processed files is stored in the file /<collector working directory>/1c_xml_connector/state.ini and has the following format: "offset=<number>\ndev=<number>\ninode=<number>".

3. Events are defined in each unread file.
4. Events from the file are processed one by one. Multi-line events are converted to single-line events.

Connector limitations:

• Installation of a collector with a 1c-xml connector is not supported in a Windows operating system. To set up file transfers of 1C log files for processing by the KUMA collector:
  1. On the Windows server, grant read access over the network to the folder with the 1C log files.
  2. On the Linux server, mount the shared folder with the 1C log files on the Windows server (see the list of supported operating systems).
  3. On the Linux server, install the collector that you want to process 1C log files from the mounted shared folder.
• Files with an incorrect event format are not read. For example, if event tags in the file are in Russian, the collector does not read such events.

  Example of a correct XML file with an event.

  <?xml version="1.0" encoding="UTF-8"?>

  <v8e:EventLog xmlns: v8e="http://v8.1c.ru/eventLog"

  xmlns:xs="http://www.w3.org/2001/XMLSchema"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

  <v8e:Event>

  <v8e:Level>Information</v8e:Level>

  <v8e:Date>2022-12-07T01:55:44+03:00</v8e:Date>

  <v8eApplicationName>generator.go</v8e:ApplicationName>

  <v8e:ApplicationPresentation>generator.go</v8e:ApplicationPresentation>

  <v8e:Event>Test event type: Count test</v8e:Event>

  <v8e:EventPresentation></v8e:Event Presentation>

  <v8e:User>abcd_1234</v8e:User>

  <v8e:UserName>TestUser</v8e:UserName>

  <v8e:Computer>Test OC</v8e:Computer>

  <v8e:Metadata></v8e:Metadata>

  <v8e:MetadataPresentation></v8e:MetadataPresentation>

  <v8e:Comment></v8e:Comment>

  <v8e:Data>

  <v8e:Name></v8e:Name>

  <v8e:CurrentOSUser></v8e:CurrentOSUser>

  </v8e:Data>

  <v8e:DataPresentation></v8e:DataPresentation>

  <v8e:TransactionStatus>NotApplicable</v8e:TransactionStatus>

  <v8e:TransactionID></v8e:TransactionID>

  <v8e:Connection>0</v8e:Connection>

  <v8e:Session></v8e:Session>

  <v8e:ServerName>kuma-test</v8e:ServerName>

  <v8e:Port>80</v8e:Port>

  <v8e:SyncPort>0</v8e:SyncPort>

  </v8e:Event>

  </v8e:EventLog>

  Example of a processed event.

  

• If a file read by the connector is enriched with the new events and if this file is not the last file read in the directory, all events from the file are processed again.