Tools

Single-Line Log Formatting Limitations in Kiwi Syslog Server NG When Receiving Multi-Line Alerts from Lenovo XCC

Lenovo ThinkAgile VX (XCC) sends fully structured, multi-line syslog messages that include multiple metadata fields. Kiwi Syslog Server NG formatting controls only affect how messages are displayed or written, not the content of the original message body. As a result, field-level filtering or extraction within Kiwi Syslog Server NG is not supported for Log to File actions.

First published date

3/2/2026 7:07 PM

Last published date

3/2/2026 7:07 PM

Product section

Kiwi Syslog Server

Resolution

Custom log formatting can be configured in Kiwi Syslog Server NG from Console > Setup > Settings > Formatting.

Image_2026-01-09_12-42-33.png

After creating a custom format based on your requirements, it is mandatory to manually assign the custom format to the Log to File action; otherwise, the default format will continue to be used.

Custom log formatting can be configured from Kiwi Syslog Server NG Console > Setup > Settings > Formatting. Any newly created format must be explicitly selected in the Log to File configuration.

Assigned this to your Log to File rule >> Add > Save

Image_2026-01-20_12-54-45.png

Regarding the line format, the Kiwi Syslog Server NG uses the RFC 3164 header format for syslog messages, which formats each syslog message as a single line consisting of a priority value, timestamp, hostname, tag, and content. This indicates that Kiwi Syslog Server NG processes syslog messages in a single-line format according to the standard syslog message structure.

  • Even when a custom format is correctly assigned, formatting in Kiwi Syslog Server NG controls only how the message is displayed or written, and does not remove or suppress content from the original syslog message body.

  • Lenovo ThinkAgile VX (XCC) sends pre-formatted, structured, multi-line syslog messages and does not provide an option to suppress individual fields such as Severity, Date, Location, or hardware details.

  • Field-level filtering (for example, keeping only the IP address and Alert Text) is not supported on the XCC side and cannot be enforced using Kiwi Syslog Server NG formatting.

  • Kiwi Syslog Server NG currently does not support regex-based field extraction or selective field removal for Log to File actions.

  • Due to these limitations, it is not possible to generate a single-line log containing only selected fields using Kiwi Syslog Server NG alone.

  • As an alternative, external log processing tools such as PowerShell, Python, Logstash, or a SIEM pipeline can be used to parse and extract required fields after the logs are written.

  • -- Scripts are not supported under any SolarWinds support program or service.
    -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
    -- disclaims all warranties including, without limitation, any implied warranties
    -- of merchantability or of fitness for a particular purpose. The risk arising
    -- out of the use or performance of the scripts and documentation stays with you.
    -- In no event shall SolarWinds or anyone else involved in the creation,
    -- production, or delivery of the scripts be liable for any damages whatsoever
    -- (including, without limitation, damages for loss of business profits, business
    -- interruption, loss of business information, or other pecuniary loss) arising
    -- out of the use of or inability to use the scripts or documentation.