I have craeted a custom parser and uploaded using GUI of Log decoder. But I am unable to see in the list of parsers in Log decoder GUI under Service Parsers Configuration where we enable the parser. I am able to see the parser file in the directory /etc/n

[TonyThomas]

I have craeted a custom parser and uploaded using GUI of Log decoder. But I am unable to see in the list of parsers in Log decoder GUI under Service Parsers Configuration where we enable the parser. I am able to see the parser file in the directory /etc/netwitness/ng/envision/etc/devices/ . Please guide

[SravanKoneti1]

Hi Tony,

Please reload the parser using : https://community.rsa.com/docs/DOC-47098 

[TonyThomas]

Hi Sravan

I already followed this procedure but still unable to see the parser. I also restarted the logdecoder service.

I will try to uplolad the parser with new one. Please let me know how can I delete the old parser and upload the new one

and do i need to restart the logdecoder service

[SravanKoneti1]

Hi Tony,

It is not required to restart logdecoder service to deploy new parser. Reloading the parser sufficient.

If you would like to remove the old parser, Follow below.

• Navigate to cd /etc/netwitness/ng/envision/etc/devices/customparser_directory
• Remove parser files using rm *

To upload new parser:

• Using WInSCP, Upload .xml and .ini files to /etc/netwitness/ng/envision/etc/devices/customparser_directory
• Then reload the parser using KB#17847

If you still can't see new parser in Logdecoder->Config page, try restarting jetty service using restart jettysrv in SA server. (This makes GUI unavailable for <5 mins.)

[DaveGlover]

If you look in the logs of the log decoder you should see an error as to unable to load the parser.  

You most likely have a syntax error in your parser xml file. 

After I tweak a parser by hand I will open the xml in Internet Explorer as that validates the xml and will alert you to errors.