Please allow us to return to logging the full RFC Structured Data instead of the auto-parsed message version.
My Situation: RSA Syslogs are being automatically parsed and significant data is no longer in logs or email alerts (username being the main one). So my logs went from looking like:
2026-07-18 23:34:13 System3.Info 192.168.6.2 1 2026-07-19T03:34:13Z 192.168.6.2 SINGLEPOINT 2238 RADIUS_USER_APPROVE_AUTHENTICATION [SINGLEPOINT@34162 STATUS="SUCCESS" CLIENT_ID="RADIUS: servicename" IN_RESPONSE_TO="xxx-xxx-xx-xxx-xxx" DESCRIPTION="RADIUS ??" Approve method authentication succeeded." SOURCE-IP-ADDRESS="192.168.5.200" RADIUS_RESPONSE_TYPE="Access-Accept" TENANT_ID="companyxyz" USER_NAME="username" REQUEST_ID="xxxx-xxx" NAS-IP-ADDRESS="192.168.5.200" POLICY_ID="All Users Low Assurance Level"] RADIUS ??" Approve method authentication succeeded.2026-07-18 23:34:13 System3.Info 192.168.6.2 1 2026-07-19T03:34:13Z 192.168.6.2 SINGLEPOINT 2238 RADIUS_USER_APPROVE_AUTHENTICATION [SINGLEPOINT@34162 STATUS="SUCCESS" CLIENT_ID="RADIUS: servicename" IN_RESPONSE_TO="xxx-xxx-xx-xxx-xxx" DESCRIPTION="RADIUS ??" Approve method authentication succeeded." SOURCE-IP-ADDRESS="192.168.5.200" RADIUS_RESPONSE_TYPE="Access-Accept" TENANT_ID="companyxyz" USER_NAME="username" REQUEST_ID="xxxx-xxx" NAS-IP-ADDRESS="192.168.5.200" POLICY_ID="All Users Low Assurance Level"] RADIUS ??" Approve method authentication succeeded.
To just:
2026-07-28 16:04:50 System3.Info 192.168.6.2 RADIUS ??? Approve method authentication succeeded.2026-07-28 16:04:50 System3.Info 192.168.6.2 RADIUS ??? Approve method authentication succeeded.
I've created a script to create a custom variable:
$Custom.RawText = $Other.VarRawMessageText
This works for email alerts but not for logging to file which is more important.
I see the data is available when I add the column "RFC Structured Data" in the Events view. Please make this an available variable for email and logging.
