Connector, 1c-xml type

Connectors of the 1c-xml type are used for getting data from 1C registration logs when working with Linux agents. When the connector handles multi-line events, it converts them into single-line events.

Settings for a connector of the 1c-xml type are described in the following tables.

Basic settings tab

Setting	Description
Name	Unique name of the resource. The maximum length of the name is 128 Unicode characters. Required setting.
Tenant	The name of the tenant that owns the resource. Required setting.
Type	Connector type: 1c-xml. Required setting.
Tags	Tags for resource search. Optional setting.
Directory path	The full path to the directory with the files that you want to interact with, for example, `/var/log/1c/logs/`. Limitations when using prefixes in file paths Prefixes that cannot be used when specifying paths to files: `/` `/bin` `/boot` `/dev` `/etc` `/home` `/lib` `/lib64` `/proc` `/root` `/run` `/sys` `/tmp` `/usr/` `/usr/bin/` `/usr/local/` `/usr/local/sbin/` `/usr/local/bin/` `/usr/sbin/` `/usr/lib/` `/usr/lib64/` `/var/` `/var/lib/` `/var/run/` `/opt/kaspersky/kuma/` Files are available at the following paths: `/opt/kaspersky/kuma/clickhouse/logs/` `/opt/kaspersky/kuma/mongodb/log/` `/opt/kaspersky/kuma/victoria-metrics/log/` Required setting.
Description	Description of the resource. The maximum length of the description is 4000 Unicode characters.

Advanced settings tab

Setting	Description
Debug	The switch enables resource logging. The toggle switch is turned off by default.
Buffer size	Buffer size in bytes for accumulating events in the RAM of the server before sending them for further processing or storage. The value must be a positive integer. Default buffer size: 1,048,576 bytes (1 MB). Maximum buffer size: 67,108,864 bytes (64 MB).
File/folder polling mode	Specifies how the connector rereads files in the directory: Monitor changes means the connector rereads files in the directory at an interval in milliseconds specified in the Poll interval, ms field if the files are not being updated. The default value. For example, if the files are constantly being updated, and the value of Request interval, ms is `5000`, the connector rereads the files continuously instead of every 5000 milliseconds. If the files are not being updated, the connector rereads them every 5000 milliseconds. Track periodically means the connector rereads files in the directory at an interval in milliseconds specified in the Polling interval, ms field, regardless of whether the files are being updated or not.
Poll interval, ms	The interval in milliseconds at which the connector rereads files in the directory. Default value: `0` means the connector rereads files in the directory every 700 milliseconds. In the File/folder polling mode drop-down list, select the mode the connector must use to reread files in the directory.
Character encoding	Character encoding. The default is UTF-8.

Connector operation diagram:

The files containing 1C logs with the XML extension are searched within the specified directory. Logs are placed in the directory either manually or using an application written in the 1C language, for example, using the ВыгрузитьЖурналРегистрации() function. The connector only supports logs received this way. For more information on how to obtain 1C logs, see the official 1C documentation.
Files are sorted by the last modification time in ascending order. All the files modified before the last read are discarded.
Information about processed files is stored in the file /<collector working directory>/1c_xml_connector/state.ini and has the following format: offset=<number>\ndev=<number>\ninode=<number>.
Events are defined in each unread file.
Events from the file are processed one by one. Multi-line events are converted to single-line events.

Connector limitations:

Installation of a collector with a 1c-xml connector is not supported in a Windows operating system. To set up transfer of 1C log files for processing by the KUMA collector:
1. On the Windows server, grant read access over the network to the folder with the 1C log files.
2. On the Linux server, mount the shared folder with the 1C log files on the Linux server (see the list of supported operating systems).
3. On the Linux server, install the collector that you want to process 1C log files from the mounted shared folder.
Files with an incorrect event format are not read. For example, if event tags in the file are in Russian, the collector does not read such events.
Example of a correct XML file with an event.

<?xml version="1.0" encoding="UTF-8"?>

<v8e:EventLog xmlns: v8e="http://v8.1c.ru/eventLog"

xmlns:xs="http://www.w3.org/2001/XMLSchema"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<v8e:Event>

<v8e:Level>Information</v8e:Level>

<v8e:Date>2022-12-07T01:55:44+03:00</v8e:Date>

<v8eApplicationName>generator.go</v8e:ApplicationName>

<v8e:ApplicationPresentation>generator.go</v8e:ApplicationPresentation>

<v8e:Event>Test event type: Count test</v8e:Event>

<v8e:EventPresentation></v8e:Event Presentation>

<v8e:User>abcd_1234</v8e:User>

<v8e:UserName>TestUser</v8e:UserName>

<v8e:Computer>Test OC</v8e:Computer>

<v8e:Metadata></v8e:Metadata>

<v8e:MetadataPresentation></v8e:MetadataPresentation>

<v8e:Comment></v8e:Comment>

<v8e:Data>

<v8e:Name></v8e:Name>

<v8e:CurrentOSUser></v8e:CurrentOSUser>

</v8e:Data>

<v8e:DataPresentation></v8e:DataPresentation>

<v8e:TransactionStatus>NotApplicable</v8e:TransactionStatus>

<v8e:TransactionID></v8e:TransactionID>

<v8e:Connection>0</v8e:Connection>

<v8e:Session></v8e:Session>

<v8e:ServerName>kuma-test</v8e:ServerName>

<v8e:Port>80</v8e:Port>

<v8e:SyncPort>0</v8e:SyncPort>

</v8e:Event>

</v8e:EventLog>

Example of a processed event.
If a file read by the connector is enriched with the new events and if this file is not the last file read in the directory, all events from the file are processed again.

Page top