Regex-Pattern/Parser does not work with liagent when collecting SAP .AUD files

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

After creating a regex-pattern/Parser for use with an Aria Operations for Logs agent (liagent) in order to parse and collect SAP .AUD files,

Even though the regex appears to be correct the log entries are not being parsed for display in the Operations for Logs UI.

Environment

Aria Operations for Logs 8.18.x

Cause

SAP audit log (.AUD) files are typically encoded in UTF-16.

The default encoding for the Operations for Logs agent is UTF-8

Resolution

Configure the Agent group to use the correct encoding for the file.

See: Collect Log Events from a Log File

The character encoding of the log files that the agent monitors. Possible values are:

• UTF-8
• UTF-16LE
• UTF-16BE

The default value is UTF-8.