Menu
▾
▴
#38 System Locale Causes Parsing Issues
Our environment is mostly English and certainly our SIEM (log collector) systems expect logs to be in English. We use SNARE on Windows platforms (2003/2008/2008R2) where the base UI language is English as well as most other language settings.
Some applications we have in non-English-speaking countries require that the "System Locale" setting be configured for their local language, for example, Russian. This setting is the code page mappings, etc. that are applied to non-UNICODE applications. The problem is that there can only be one System Locale at a time and with it set to Russian, the Day and Month outputs from SNARE are odd ANSI characters (and certainly not English, which is what we require). This causes the SIEM systems to be unable to parse the events.
Ideally, SNARE needs to be updated to be UNICODE-compliant so support these non-Latin character sets. In addition a patch to allow the configuration of the language that events' date stamps are output in would be greatly appreciated. It would be useful to many whose system are expecting date stamps in a certain language.
Thanks in advance.