Siemens SIMATIC PCS 7

12.05.2020 13:40:35.357 PID=6128 TID=15760 C  *CCDmRtServer: CChannel::StopCyclicReadRequest() on channel SIMATIC S7 Protocol Suite failed with error 0x800401fd in line SharedMemory.cpp (@387)

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

# Regular expression to read the message contents with named groups
define DATA_MANAGER_REGEX /(?x)^(\d+.\d+.\d+)\s+(\d+:\d+:\d+).\d+\
                          \s+PID=(?<PID>\d+)\s+TID=(?<TID>\d+)\s+\
                          (?<ParamFive>\w+)\s+\S(?<Loader>\w+):\s+\
                          (?<Message>.*)/
# Path to the folder with log files
define DIAGNOSE_PATH      C:\Program Files (x86)\SIEMENS\WinCC\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

<Input from_file>
    Module        im_file
    File          '%DIAGNOSE_PATH%\CCDmRtServer.log'
    InputType     _charconv
    <Exec>
        if $raw_event =~ %DATA_MANAGER_REGEX%
        {
            # Creating a timestamp from the data and time values
            $EventTime = strptime($1 + $2,"%d.%m.%Y %T");
            to_json();    # Conversion to JSON format
        }
        else drop();      # Discarding messages not matching DATA_MANAGER_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-21T21:36:30.324551+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Loader": "CCDmRtServer",
  "Message": "CChannel::StopCyclicReadRequest() on channel SIMATIC S7 Protocol Suite failed with error 0x800401fd in line SharedMemory.cpp (@387)",
  "PID": "6128",
  "ParamFive": "C",
  "TID": "15760",
  "EventTime": "2020-05-12T13:40:35.000000+03:00"
}

2020-05-04 14:29:05,502 INFO     | LogFileName   : C:\Program Files (x86)\SIEMENS\WINCC\Diagnose\SIMATIC_S7_Protocol_Suite_01.LOG

define CHANNEL_REGEX /(?x)^(\d+-\d+-\d+)\s(\d+:\d+:\d+),\
                     \d+\s+(?<Type>\w+)\s+(?<Message>.*)/

# Regular expression to read the message contents
define CHANNEL_REGEX /(?x)^(\d+-\d+-\d+)\s(\d+:\d+:\d+),\
                     \d+\s+(?<Type>\w+)\s+(?<Message>.*)/
# Path to the folder with log files
define DIAGNOSE_PATH C:\Program Files (x86)\SIEMENS\WinCC\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    # Using the asterisk in the file name enables reading of rotated files
    File          '%DIAGNOSE_PATH%\SIMATIC_S7_Protocol_Suite_*.log'
    <Exec>
        if $raw_event =~ %CHANNEL_REGEX%
        {
            # Creating a timestamp from the data and time values
            $EventTime = strptime($1 + $2,"%Y-%m-%d %T");
            to_json();    # Conversion to JSON format
        }
        else drop();      # Discarding messages not matching CHANNEL_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-08T23:11:36.670055+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "| LogFileName   : C:\\Program Files (x86)\\SIEMENS\\WINCC\\Diagnose\\SIMATIC_S7_Protocol_Suite_01.LOG",
  "Type": "INFO",
  "EventTime": "2020-05-04T14:29:05.000000+03:00"
}

CCDeltaLoader.exe : 24.04.2020 23:14:31 : Log C:\Program Files (x86)\SIEMENS\WINCC\Diagnose\CCDeltaLoader.Log started.

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

define DELTA_REGEX   /(?x)^(?<Loader>[a-zA-Z.]*)\s+:\s+(\d+.\d+.\d+)\
                     \s(\d+:\d+:\d+)\s:\s(?<Message>[\w():.\\\s]*)/

# Regular expression with named groups for reading messages
define DELTA_REGEX   /(?x)^(?<Loader>[a-zA-Z.]*)\s+:\s+(\d+.\d+.\d+)\
                     \s(\d+:\d+:\d+)\s:\s(?<Message>[\w():.\\\s]*)/
# Path to the folder with logs
define DIAGNOSE_PATH C:\Program Files (x86)\siemens\wincc\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

<Input from_file>
    Module        im_file
    File          '%DIAGNOSE_PATH%\CCDeltaLoader.Log'
    InputType     _charconv
    <Exec>
        if $raw_event =~ %DELTA_REGEX%
        {
            # Creating a timestamp from the date and time values
            $EventTime = strptime($2 + $3,"%d.%m.%Y %T");
            to_json();    # Conversion to JSON
        }
        else drop();      # Discarding if the DELTA_REGEX pattern is not matched
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-08T23:31:09.157668+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Loader": "CCDeltaLoader.exe",
  "Message": "Log C:\\Program Files (x86)\\SIEMENS\\WINCC\\Diagnose\\CCDeltaLoader.Log started.",
  "EventTime": "2020-04-24T23:14:31.000000+03:00"
}

05/05/2020 	 17:49:51 	 Event Type: E 	 Event ID: 2134
The computer name no longer matches the computer name in the OPC UA configuration.

Update the OPC UA configuration with the 'SIMATIC NET Configuration --> OPC Settings --> OPC UA Certificates --> Recreate OPC UA configuration' function of the 'Communication Settings' program.

<Extension _multiline>
    Module        xm_multiline
    # Parsing the header line
    HeaderLine    OPC_UA_LOG_HEADER
</Extension>

# Regular expression for recognizing the message header
define OPC_UA_LOG_HEADER /(?x)^\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+[\d\w\s:]*\d+/
# Path to the folder with log files
define OPC_UA_PATH       C:\ProgramData\Siemens\Automation\Logfiles

<Extension _multiline>
    Module        xm_multiline
    # Parsing the header line
    HeaderLine    %OPC_UA_LOG_HEADER%
</Extension>

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%OPC_UA_PATH%\sinec2.log'
    InputType     _multiline
    <Exec>
        $Message = $raw_event;
        # Replacing the `\r\n` and `\t` combinations with white spaces
        $Message = replace($Message, "\r\n" , " ");
        $Message = replace($Message, "\t" , " ");
        to_json();        # Conversion of the read data to JSON
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-09-30T19:07:46.225581+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "05/05/2020   17:49:51   Event Type: E   Event ID: 2134  The computer name no longer matches the computer name in the OPC UA configuration.  Update the OPC UA configuration with the 'SIMATIC NET Configuration --> OPC Settings --> OPC UA Certificates --> Recreate OPC UA configuration' function of the 'Communication Settings' program."
}

2020-10-08 21:44:17.969 PM( 1228-02768) CServiceModule::Run Service is started

define PM_REGEX       /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+).\d+\s+\
                      (?<Type>\w+)\(\s*(?<PID>\d*)\-(?<TID>\d*)\)\
                      \s*(?<Message>.*)/

# Regular expression for parsing log entries with named groups
define PM_REGEX       /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+).\d+\s+\
                      (?<Type>\w+)\(\s*(?<PID>\d*)\-(?<TID>\d*)\)\
                      \s*(?<Message>.*)/
# Path to the folder with log files
define DIAGNOSE_PATH  C:\Program Files (x86)\SIEMENS\WinCC\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%DIAGNOSE_PATH%\PM*.log'
    <Exec>
        if $raw_event =~ %PM_REGEX%
        {
            # Transforming the date and time values to the single timestamp
            $EventTime = strptime($1 + $2,"%Y-%m-%d %T");
            to_json();    # Converting to JSON
        }
        else drop();      # Discarding messages if not matching the PM_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-21T18:53:08.336289+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "CServiceModule::Run Service is started",
  "PID": "1228",
  "TID": "02768",
  "Type": "PM",
  "EventTime": "2020-10-08T21:44:17.000000+03:00"
}

      3; 2020-04-20T22:08:48.327Z;  3356;  2844; [0x5A098658]; BCS\ECT; E; CBCSEqmControlConfig::LoadConfigFromIniFile; "GetCurrentDbIdent failed with hr=0x80040500"

define TRACE_REGEX  /(?x)^[^\w\d]*(\d*);\s*(\d*-\d*\
                    -\d*\w\d*:\d*:\d*.\d*\w);\s*(?<PID>\d*);\
                    \s*(?<TID>\d*);\s*\[(?<Address>\w*\d*)\];\
                    \s(?<Process>[\w\\]*);\s*(?<ParamSeven>\w*)\
                    ;(?<MessageOne>.*);\s*\"(?<MessageTwo>.*)\"/

# Regular expression for parsing logs
define TRACE_REGEX  /(?x)^[^\w\d]*(\d*);\s*(\d*-\d*\
                    -\d*\w\d*:\d*:\d*.\d*\w);\s*(?<PID>\d*);\
                    \s*(?<TID>\d*);\s*\[(?<Address>\w*\d*)\];\
                    \s(?<Process>[\w\\]*);\s*(?<ParamSeven>\w*)\
                    ;(?<MessageOne>.*);\s*\"(?<MessageTwo>.*)\"/
# Path to the folder with the trace files
define TRACE_PATH   C:\ProgramData\Siemens\Logs\REGSVR32\trace

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%TRACE_PATH%\*'
    <Exec>
        if $raw_event =~ %TRACE_REGEX% 
        {
            # Converting to integer
            $EntryNumber = integer($1);
            # Parsing the timestamp
            $Timestamp = parsedate($2);
            to_json();    # Converting to JSON
        }
        else drop();      # Discarding messages if not matching TRACE_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-21T22:22:58.971760+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Address": "0x5A098658",
  "MessageOne": " CBCSEqmControlConfig::LoadConfigFromIniFile",
  "MessageTwo": "GetCurrentDbIdent failed with hr=0x80040500",
  "PID": "3356",
  "ParamSeven": "E",
  "Process": "BCS\\ECT",
  "TID": "2844",
  "EntryNumber": 3,
  "Timestamp": "2020-04-21T01:08:48.327000+03:00"
}

08.10.2020 21:44:27   OnChangeState [0]

define EVENT_REGEX   /(?x)^(\d+.\d+.\d+)\s+(\d+:\d+:\d+)\s+(?<Message>.*)/

# Regular expression for parsing user context surrogate logs
define EVENT_REGEX   /(?x)^(\d+.\d+.\d+)\s+(\d+:\d+:\d+)\s+(?<Message>.*)/
# Path to the folder with logs
define DIAGNOSE_PATH C:\Program Files (x86)\SIEMENS\WinCC\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%DIAGNOSE_PATH%\CUCSurrogate.log'
    <Exec>
        if $raw_event =~ %EVENT_REGEX%
        {
            # Converting the date and time values to the single timestamp
            $EventTime = strptime($1 + $2,"%d.%m.%Y %T");
            to_json();    # Converting the data to JSON format
        }
        else drop();      # Discarding messages if not matching EVENT_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-09T13:35:47.981193+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "OnChangeState [0]",
  "EventTime": "2020-10-08T21:44:27.000000+03:00"
}

2303,30.04.2022,23:49:41:770,1000204,4,,WINSRV99,DataManager Runtime,S7$Program(1)	Connection 'S7$Program(1)' disconnected,MSG_STATE_COME

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

# Regular expression for WinCC startup and runtime logs
define STARTUP_REGEX /(?x)^(?<ID>\d+)\,(\d+.\d+.\d+)\,(\d+\:\d+\:\d+)\:\d+\,\
                     (?<MessageNumber>\d+)\,(?<MessageClass>\d+)\,\
                     (?<UserName>.*?)\,(?<Station>.*?)\,(?<Application>.*?)\,\
                     (?<ErrorMessage>.*?)\,(?<State>.*[^,])$/

# Regular expression for operator log messages
define OP_REGEX      /(?x)^(?<ID>\d+)\,(\d+.\d+.\d+)\,(\d+:\d+:\d+):\d+\,\
                    (?<MessageNumber>\d+)\,(?<MessageClass>\d+)\,\
                    (?<UserName>.*?)\,(?<Station>.*?)\,(?<Application>.*?)\,\
                    (?<ErrorMessage>.*?)\,(?<VarName>.*?)\,(?<OldValue>.*?)\,\
                    (?<NewValue>.*?)\,(?<State>.*?)\,(?<Reason>.*?)\,+/

# Regular expression for WinCC startup and runtime logs
define STARTUP_REGEX /(?x)^(?<ID>\d+)\,(\d+.\d+.\d+)\,(\d+\:\d+\:\d+)\:\d+\,\
                     (?<MessageNumber>\d+)\,(?<MessageClass>\d+)\,\
                     (?<UserName>.*?)\,(?<Station>.*?)\,(?<Application>.*?)\,\
                     (?<ErrorMessage>.*?)\,(?<State>.*[^,])$/

# Regular expression for operator log messages
define OP_REGEX      /(?x)^(?<ID>\d+)\,(\d+.\d+.\d+)\,(\d+:\d+:\d+):\d+\,\
                     (?<MessageNumber>\d+)\,(?<MessageClass>\d+)\,\
                     (?<UserName>.*?)\,(?<Station>.*?)\,(?<Application>.*?)\,\
                     (?<ErrorMessage>.*?)\,(?<VarName>.*?)\,(?<OldValue>.*?)\,\
                     (?<NewValue>.*?)\,(?<State>.*?)\,(?<Reason>.*?)\,+/

# Path to the folder with log files
define DIAGNOSE_PATH C:\Program Files (x86)\Siemens\WinCC\diagnose

<Extension json>
    Module        xm_json
</Extension>

<Extension _charconv>
    Module        xm_charconv
    # Converting data from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

<Input from_file>
    Module        im_file
    File          '%DIAGNOSE_PATH%\WinCC_[OS]*.log'
    InputType     _charconv
    <Exec>
        # Replaces unwanted characters
        $raw_event =~ s/\t/ /g;
        # Matches the events with a regular expressions
        if $raw_event =~ %STARTUP_REGEX% or $raw_event =~ %OP_REGEX%
        {
            # Processing timestamp
            $EventTime = strptime($2 + $3,"%d.%m.%Y%T");
            # Converting to JSON
            to_json();
        }
        # Discarding messages if they do not match
        else drop();
    </Exec>
</Input>

{
  "EventReceivedTime": "2022-04-30T23:49:42.785431+02:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Application": "DataManager Runtime",
  "ErrorMessage": "S7$Program(1) Connection 'S7$Program(1)' disconnected",
  "ID": "2303",
  "MessageClass": "4",
  "MessageNumber": "1000204",
  "State": "MSG_STATE_COME",
  "Station": "WINSRV99",
  "UserName": "",
  "EventTime": "2022-04-30T23:49:41.000000+02:00"
}

2020-10-08 21:40:01 - ? [495] The SQL Server Agent startup service account is WORKGROUP\WINSRV99$.

<Extension _charconv>
    Module        xm_charconv
    # Conversion from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

define EVENT_SQLAGENT  /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+)\
                       \s+-\s+\W\s+(?<Message>.*)/

# Regular expression for reading logs
define EVENT_SQLAGENT  /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+)\
                       \s+-\s+\W\s+(?<Message>.*)/
# Path to the folder with SQL log files
define SQL_SERVER_PATH C:\Program Files (x86)\Microsoft SQL Server

<Extension _charconv>
    Module        xm_charconv
    # Converting from UCS-2LE to UTF-8
    LineReader    UCS-2LE
</Extension>

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%SQL_SERVER_PATH%\MSSQL12.WINCC\MSSQL\Log\SQLAGENT.*'
    InputType     _charconv
    <Exec>
        if $raw_event =~ %EVENT_SQLAGENT%
        {
            # Converting of the data and time values to the single timestamp
            $EventTime = strptime($1 + $2, "%Y-%m-%d %T");
            to_json();    # Converting to JSON
        }
        else drop();      # Discarding messages if not matching EVENT_SQLAGENT
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-18T23:13:17.546939+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "[495] The SQL Server Agent startup service account is WORKGROUP\\WINSRV99$.",
  "EventTime": "2020-10-08T21:40:01.000000+03:00"
}

2020-02-10 08:48:12.803 [p=11912, t=0x3370] Sync: Redundancy is not activated

define ARCHIVE_REGEX /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+).\
                     \d+\s+\[p=(?<PID>\d+),\s+t=(?<TID>.*)\
                     \]\s+(?<Message>.*)/

# Regular expression for parsing user archives
define ARCHIVE_REGEX /(?x)^(\d+-\d+-\d+)\s+(\d+:\d+:\d+).\
                     \d+\s+\[p=(?<PID>\d+),\s+t=(?<TID>.*)\
                     \]\s+(?<Message>.*)/
# Path to the folder with logs
define PROJECT_PATH  C:\Users\Engineer\Documents\Project\BEV_MP

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\Hmi\wincproj\HMI\UA\UALogFile.txt'
    <Exec>
        if $raw_event =~ %ARCHIVE_REGEX%
        {
            # Converting the date and time values to the single timestamp
            $EventTime = strptime($1 + $2,"%Y-%m-%d %T");
            to_json();    # Converting parsed data to JSON
        }
        else drop();      # Discarding messages if not matching ARCHIVE_REGEX
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-21T22:58:52.266852+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "Sync: Redundancy is not activated",
  "PID": "11912",
  "TID": "0x3370",
  "EventTime": "2020-02-10T08:48:12.000000+02:00"
}

 ***** Protocol Of Loading <BEV_Prj\SIMATIC 400(1)\CPU 417-5 H PN/DP\S7 Program(1)\Charts> on 03/13/20 11:53:04

[11:56:00.828 AM] EM_CIP_PROC.EM_CIP_PROC [DB133] (OVERLOAD)

[11:59:33.618 AM] POOL_DB_DBE (LOADED)

# Regular expression to recognize the message header
define REGEX_LOADPROT_HEADER /(?x)^\s?\**(?<Type>[\w\s]*)\<(?<Path>\
                             [-_ \\\/\(\)\d*\w*]*)\>\s*on\s*(?<Date>\
                             \d+\/\d+\/\d+)\s*(?<Time>\d+:\d+:\d+)/
# Regular expression for processing the first type of logs
define REGEX_LOADPROT_ONE    /(?x)^\[?(?<Time>\d+:\d+:\d+.\d+)\s*\
                             (?<Daypart>AM|PM)\]?\s*(?<Process>\
                             [._ \(\)~@\-\w]*)\[(?<ParamFour>[\w\d]*)\]\
                             \s*\((?<Status>[\w]*)\)/
# Regular expression for processing the second type of logs
define REGEX_LOADPROT_TWO    /(?x)^\[?(?<Time>\d+:\d+:\d+.\d+)\s*\
                             (?<Daypart>AM|PM)\]?\s*(?<Process>.*)\
                             \s*\((?<Status>.*)\)/

# Regular expression to recognize the message header
define REGEX_LOADPROT_HEADER /(?x)^\s?\**(?<Type>[\w\s]*)\<(?<Path>\
                             [-_ \\\/\(\)\d*\w*]*)\>\s*on\s*(?<Date>\
                             \d+\/\d+\/\d+)\s*(?<Time>\d+:\d+:\d+)/
# Regular expression for processing the first type of logs
define REGEX_LOADPROT_ONE    /(?x)^\[?(?<Time>\d+:\d+:\d+.\d+)\s*\
                             (?<Daypart>AM|PM)\]?\s*(?<Process>\
                             [._ \(\)~@\-\w]*)\[(?<ParamFour>[\w\d]*)\]\
                             \s*\((?<Status>[\w]*)\)/
# Regular expression for processing the second type of logs
define REGEX_LOADPROT_TWO    /(?x)^\[?(?<Time>\d+:\d+:\d+.\d+)\s*\
                             (?<Daypart>AM|PM)\]?\s*(?<Process>.*)\
                             \s*\((?<Status>.*)\)/
# Path to the Automation Station project folder 
define PROJECT_PATH          C:\Users\Engineer\Documents\Project\BEV_MP

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\BEV_Prj\ES_LOC\1\GEN\loadprot.log'
    <Exec>
        # Converting parsed data to JSON
        if $raw_event =~ %REGEX_LOADPROT_HEADER% to_json();
        else if $raw_event =~ %REGEX_LOADPROT_ONE% to_json();
        else if $raw_event =~ %REGEX_LOADPROT_TWO% to_json();
        else drop();      # Discard event if it doesn't match a/the regular expression
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-09T22:15:10.553269+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Date": "03/13/20",
  "Path": "BEV_Prj\\SIMATIC 400(1)\\CPU 417-5 H PN/DP\\S7 Program(1)\\Charts",
  "Time": "11:53:04",
  "Type": " Protocol Of Loading "
}

{
  "EventReceivedTime": "2020-10-09T22:15:10.553269+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Daypart": "AM",
  "ParamFour": "DB133",
  "Process": "EM_CIP_PROC.EM_CIP_PROC ",
  "Status": "OVERLOAD",
  "Time": "11:56:00.828"
}

{
  "EventReceivedTime": "2020-10-09T22:48:45.054997+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Daypart": "AM",
  "Process": "POOL_DB_DBE ",
  "Status": "LOADED",
  "Time": "11:59:33.618"
}

 ***** LoadRefs of <BEV_Prj\SIMATIC 400(1)\CPU 417-5 H PN/DP\S7 Program(1)\Charts> on 05/07/20 16:49:04

OB55 [FC30]          (LD ) -> (LD ) -> @(1).SIMATIC_400(1)_1 [DB76] (LD )

# Regular expression for parsing headers
define REGEX_LOADREF_HEADER /(?x)^\s?\**(?<Type>[\w ]*)\<(?<Path>\
                            [-_ \\\/\(\)\d*\w*]*)\>\s*on\s*(?<Date>\
                            \d+\/\d+\/\d+)\s*(?<Time>\d+:\d+:\d+)/
# Regular expression for parsing log entries
define REGEX_LOADREF_ONE    /(?x)^(?<ParamOne>[\(\)@\d\w_]*)\s*\
                            \[(?<ParamTwo>[\w\d]*)\]\s*\((?<ParamThree>[\w]\
                            *\s*)\s*?\)\s*->\s*\((?<ParamFour>[\w]*\s*)\)\s*\
                            ->\s(?<ParamFive>[\(\)@\w_.-]*)\s*(?:\[(?<ParamSix>\
                            [\w\d]*)\])?\s*\((?<ParamSeven>[\w]*)\s*\)/

# Regular expression for parsing headers
define REGEX_LOADREF_HEADER /(?x)^\s?\**(?<Type>[\w ]*)\<(?<Path>\
                            [-_ \\\/\(\)\d*\w*]*)\>\s*on\s*(?<Date>\
                            \d+\/\d+\/\d+)\s*(?<Time>\d+:\d+:\d+)/
# Regular expression for parsing log entries
define REGEX_LOADREF_ONE    /(?x)^(?<ParamOne>[\(\)@\d\w_]*)\s*\
                            \[(?<ParamTwo>[\w\d]*)\]\s*\((?<ParamThree>[\w]\
                            *\s*)\s*?\)\s*->\s*\((?<ParamFour>[\w]*\s*)\)\s*\
                            ->\s(?<ParamFive>[\(\)@\w_.-]*)\s*(?:\[(?<ParamSix>\
                            [\w\d]*)\])?\s*\((?<ParamSeven>[\w]*)\s*\)/
# Path to the AS project folder
define PROJECT_PATH         C:\Users\Engineer\Documents\Project\BEV_MP

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\VR_Lib\ES_LOC\1\GEN\loadrefs.log'
    <Exec>
        if $raw_event =~ %REGEX_LOADREF_HEADER% 
        {
            $Type = replace($Type, " LoadRefs of ", "LoadRefs");
            to_json();    # Converting to JSON format
        }
        else if $raw_event =~ %REGEX_LOADREF_ONE% to_json();
        else drop();      # Discard event if it doesn't match a/the regular expression
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-12T12:33:10.992481+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Date": "05/07/20",
  "Path": "BEV_Prj\\SIMATIC 400(1)\\CPU 417-5 H PN/DP\\S7 Program(1)\\Charts",
  "Time": "16:49:04",
  "Type": "LoadRefs"
}

{
  "EventReceivedTime": "2020-10-11T17:29:12.059800+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "ParamFive": "@(1).SIMATIC_400(1)_1",
  "ParamFour": "LD ",
  "ParamOne": "OB55",
  "ParamSeven": "LD",
  "ParamSix": "DB76",
  "ParamThree": "LD ",
  "ParamTwo": "FC30"
}

Synchronization of the shared declarations on 07.05.2020 14:17:59
Selected object: Shared Declarations BEV_Lib
Actions were performed during the synchronization of the shared declarations in the following projects/libraries  and a log was created:

Project BEV_Prj

Project HMI

<Extension _multiline>
    Module        xm_multiline
    # Parsing the header line
    HeaderLine    /^Synchronization.*on\s+\d+.\d+.\d+\s+\d+:\d+:\d+$/
</Extension>

# Path to the multiproject folder
define PROJECT_PATH C:\Users\Engineer\Documents\Project\BEV_MP

<Extension _multiline>
    Module        xm_multiline
    # Regular expression to recognize the message header
    HeaderLine    /^Synchronization.*on\s+\d+.\d+.\d+\s+\d+:\d+:\d+$/
</Extension>

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\BEV_MP\Global\GDAlignError.log'
    InputType     _multiline
    <Exec>
        $Message = $raw_event;
        # Replacing the `\r\n` combinations with white spaces
        $Message = replace($Message, "\r\n" , " ");
        to_json();        # Converting the parsed data to JSON format
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-09-30T13:56:54.967315+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "Synchronization of the shared declarations on 07.05.2020 14:17:59 Selected object: Shared Declarations BEV_Lib Actions were performed during the synchronization of the shared declarations in the following projects/libraries  and a log was created:  Project BEV_Prj  Project HMI "
}

Import/Export Assistant log file from:  Wednesday, February 26, 2020 11:25:51

BEV_Prj\PCELL\CIP\RETURN\CM\\LSHRM3\LH_RM3.EN	OK	Process tag parameter flag reset.

# Regular expression for parsing headers
define ASSIST_REGEX_HEADER}  /(?x)^(?<Message>.*)from:\s*(?<DayOfWeek>\w*),\
                            \s*(?<Month>\w*)\s*(\d*),\s*(\d*)\
                            \s*(?<Time>\d*:\d*:\d*)/
# Regular expression for parsing log entries
define ASSIST_REGEX_LOG     /(?x)^(?<Path>.*)\s+(?<Status>OK|ERROR|Error)\
                            \s+(?<Message>.*)/

# Regular expression for parsing headers
define ASSIST_REGEX_HEADER  /(?x)^(?<Message>.*)from:\s*(?<DayOfWeek>\w*),\
                            \s*(?<Month>\w*)\s*(\d*),\s*(\d*)\
                            \s*(?<Time>\d*:\d*:\d*)/
# Regular expression for parsing log entries
define ASSIST_REGEX_LOG     /(?x)^(?<Path>.*)\s+(?<Status>OK|ERROR|Error)\
                            \s+(?<Message>.*)/
# Path to the multiproject folder
define PROJECT_PATH         C:\Users\Engineer\Documents\Project\BEV_MP

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\BEV_Lib\Global\modify.log'
    <Exec>
        # Converting messages to JSON format
        if $raw_event =~ %ASSIST_REGEX_HEADER%
        {
            # Converting the date and year values to integers
            $Date = integer($4);
            $Year = integer($5);
            to_json();    # Converting to JSON
        }
        else if $raw_event =~ %ASSIST_REGEX_LOG% to_json(); # Converting to JSON
        else drop();      # Discard event if it doesn't match a/the regular expression
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-10-22T13:11:42.590475+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "DayOfWeek": "Wednesday",
  "Message": "Import/Export Assistant log file ",
  "Month": "February",
  "Time": "11:25:51",
  "Date": 26,
  "Year": 2020
}

{
  "EventReceivedTime": "2020-10-12T15:55:18.931486+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "Process tag parameter flag reset.",
  "Path": "BEV_Prj\\PCELL\\CIP\\RETURN\\CM\\\\LSHRM3\\LH_RM3.EN",
  "Status": "OK"
}

The following S7 programs were selected for checking:
-> BEV_Lib\S7 Program(1)
-> BEV_Prj\SIMATIC 400(1)\CPU 417-5 H PN/DP\S7 Program(1)
-> VR_Lib\S7 Program(1)

No different blocks found. The central type import will be closed.

End of central type update 05.05.2020 19:47:54

<Extension _multiline>
    Module        xm_multiline
    # Parsing the header line
    HeaderLine    /^.*:$/
</Extension>

# The path to the multiproject folder
define PROJECT_PATH C:\Users\Engineer\Documents\Project\BEV_MP

<Extension _multiline>
    Module        xm_multiline
    HeaderLine    /^.*:$/
</Extension>

<Extension json>
    Module        xm_json
</Extension>

<Input from_file>
    Module        im_file
    File          '%PROJECT_PATH%\BEV_Lib\@CentralBstActualize*.TXT'
    InputType     _multiline
    <Exec>
        $Message = $raw_event;
        # Replacing the `-> ` and `\r\n` combinations with white spaces
        $Message = replace($Message, "-> ", " ");
        $Message = replace($Message, "\r\n", " ");
        to_json();        # Converting the result to JSON
    </Exec>
</Input>

{
  "EventReceivedTime": "2020-09-30T15:01:37.686454+03:00",
  "SourceModuleName": "from_file",
  "SourceModuleType": "im_file",
  "Message": "The following S7 programs were selected for checking:  BEV_Lib\\S7 Program(1)  BEV_Prj\\SIMATIC 400(1)\\CPU 417-5 H PN/DP\\S7 Program(1)  VR_Lib\\S7 Program(1)  No different blocks found. The central type import will be closed.  End of central type update 05.05.2020 19:47:54"
}