Gathering jobs based on the Microsoft SQL Server Error Log data source may finish with the "The log file contains an invalid record" warnings (4254788)

Gathering jobs based on the Microsoft SQL Server Error Log data source may finish with the "The log file contains an invalid record" warnings, and data for some log entries may be missing in the target repository or/and database.

This is most likely to happen when some entries in the collected ERRORLOG file(s) do not have data in the 'Source' data field. As all the other Custom Text Log Events type data sources, the Microsoft SQL Server Error Log data source is based on regular expressions that are used to parse text log entries into data fields matching predefined patterns. The regular expression used in this specific data source uses the '(\w+)' pattern to find the text to be stored as the 'Source' data field of the collected event. This pattern supposes that this data field has a value presented by at least one character. If a log entry does not have anything specified as Source, the pattern is not matched, the log record is skipped as an invalid one and not stored to the target repository or/and database as a collected log event.

The most easy and straightforward resolution is to edit regular expression in the data source to make it allow empty text pattern as a valid value for the Source data field of a collected event. To provide for this, '(\w+)' in the regular expression should be replaced with '(\w*)'.

To achieve this with the minimum risk of making a mistake, do the following:

1. In the InTrust Manager left pane, select the '\Configuration\Data Sources' node in the tree.
2. In the right pane, select the 'Microsoft SQL Server Error Log' entry and open its properties.
3. In the data source properties dialog, select the Settings tab and then click the Edit button.
4. On the first step of the Edit Custom Text Log Data Source Wizard, click Next.
5. On the second step of the Wizard (titled 'Regular Expressions'), select the line with a regular expression in the lower part of the dialog page and click the Edit button.
6. In the 'Add/Edit Regular Expression' dialog, select the whole text of the regular expression and replace it with the following line of text (without double quotes): "^(\d\d\d\d-\d\d\-\d\d)\s(\d\d:\d\d:\d\d)\.\d\d\s(\w*)(\s+)(.+)[\r\n]+".
7. Click OK in the 'Add/Edit Regular Expression' dialog, then keep clicking Next in Edit Custom Text Log Data Source Wizard until you see the Finish button, and click Finish.
8. Click OK in the data source properties dialog to save the changes you have made to the data source settings.
9. Click on the blue check mark in the InTrust Manager toolbar to commit the changes to the InTrust configuration database.

If, earlier, you created some data sources by making copies of the 'Microsoft SQL Server Error Log' data source and editing some of their settings (like paths to log files and so on), repeat steps 1 to 10 above for each data source created as a clone of 'Microsoft SQL Server Error Log'.

If, earlier, you edited the the regular expression in one of the data sources based on 'Microsoft SQL Server Error Log' as a template, don't replace the text of your existing regular expression with the text line above but rather find the '(\w+)' in it and replace it with '(\w*)'.