Re: How to classify syslog events

Yeah I've got a few of those too.. but the one above is incorrectly parsed so I'd like to learn how to change it.

2013-07-23 11:26:59,419 INFO zen.Syslog: No matching parser: 'system,info log action changed by admin'

2013-07-23 12:31:42,755 INFO zen.Syslog: No matching parser: 'system,info,account user admin logged in from 10.0.71.111 via ssh'

2013-07-23 13:36:16,365 INFO zen.Syslog: No matching parser: 'MikroTik [Comp44] log action changed by admin'

2013-07-23 13:40:20,459 INFO zen.Syslog: No matching parser: 'MikroTik [Comp44] log action changed by admin'

2013-07-23 13:40:30,092 INFO zen.Syslog: No matching parser: 'MikroTik [Comp44] log action changed by admin'

2013-07-23 13:44:15,711 INFO zen.Syslog: No matching parser: 'system,info log action changed by admin'

2013-07-23 14:11:53,500 INFO zen.Syslog: No matching parser: 'pptp,info TCP connection established from 123.151.149.222'

2013-07-23 14:43:48,499 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP deassigned 10.0.71.114 from F0:4F:7C:5F:AF:98'

2013-07-23 14:48:37,956 INFO zen.Syslog: No matching parser: 'system,info filter rule changed by admin'

2013-07-23 17:30:40,194 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP assigned 10.0.71.114 to F0:4F:7C:5F:AF:98'

2013-07-23 18:13:13,415 INFO zen.Syslog: No matching parser: 'pptp,info TCP connection established from 123.151.149.222'

2013-07-23 18:27:28,372 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP deassigned 10.0.71.194 from 10:9A:DD:BE:BF:4E'

2013-07-23 18:42:51,751 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP assigned 10.0.71.194 to 10:9A:DD:BE:BF:4E'

2013-07-23 19:47:11,607 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP deassigned 10.0.71.193 from 90:18:7C:45:5C:C1'

2013-07-23 20:29:43,683 INFO zen.Syslog: No matching parser: 'dhcp,info 71_Desktop_DHCP assigned 10.0.71.193 to 90:18:7C:45:5C:C1'

2013-07-23 21:37:26,298 INFO zen.Syslog: No matching parser: 'system,info,account user admin logged out from 10.0.71.111 via ssh'

2013-07-23 22:16:56,407 INFO zen.Syslog: No matching parser: 'pptp,info TCP connection established from 123.151.149.222'