Parsing log files needs tab character

Hi:

I've got some rather large (24MB) log files and would like to parse them outside of NOD32. The problem is that the error/information message from NOD32 isn't separated clearly from the file/path it is referring to. Most messages are separated by ' - ', but that string is contained in some paths or filenames as well.

What's needed is an unambiguous message character in the output string, like the tab character (0x09). I thought it was in one of the logs of 4.x, but now I see it's just the space characters as normal.

Is there a setting somewhere where this can be set?

Thank you in advance.

-- Roy Zider

NOD32 2.7, 3.x and 4.x in use

 

I'm using v. 4.2.35 and the entries in columns are indeed separated by a tab when exported to a text file

 

Marcos:

Using 4.0.417 here -- don't see that in this version. Is this a releatively recent change? There's no separation in the .xml file export either.

As I said, I thought I had it, but now can't find it. Is there a changelog around here somewhere?

Thanks.

-- Roy

 

This log was created using v. 4.0.417:

 

Marco:

Ahh, that explains it. We're looking at different records. You have posted (very nicely I might add) the hex view of a summary record, whereas I am trying to parse the detail records of an on-demand scan.

Unfortunately the log screens have similar labels, so there is some confusion here. On the screen shots that have Time, Scanned Folders, Scanned, etc, I get tabs too. But on the screen which has all the message detail, headed "Log" only, there are no tabs. Do you see what I'm looking at now?

-- Roy

 

On-demand scanner logs have always had a structure like this since NOD32 v1 (or even probably NOD32 for DOS). I've successfully used a parser to parse these kind of logs but moved to ecls logs when v3 became available. A possible solution would be bordering the path with speech marks but this might cause troubles to other users who have accustomed the parsers to the current format in the past.

 

Thanks, Marcos. As the subject line says, a simple tab character separation between object and message would solve this.

-- Roy