Reparsing unsuccessfully parsed event data in a security information and event management system

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

• determine whether one or more unsuccessfully parsed event data items exist for a log source, wherein an unsuccessfully parsed event data item is an event data item where previous parsing failed, wherein the computer readable program causing the computing device to determine whether the one or more unsuccessfully parsed event data items exist for the log source is performed based on the device support module associated with the log source being updated;
• responsive to one or more unsuccessfully parsed event data items existing, reparse each unsuccessfully parsed event data item of the one or more unsuccessfully parsed event data items using an updated device support module associated with the log source;
• and
• responsive to the device support module failing to successfully reparse the unsuccessfully parsed event data item, retain the unsuccessfully parsed event data item in an unsuccessfully parsed event data item data structure.

A system comprising:

• a processor, and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to:
• determine whether one or more unsuccessfully parsed event data items exist for a log source, wherein an unsuccessfully parsed event data item is an event data item where previous parsing failed, wherein the instructions causing the processor to determine whether the one or more unsuccessfully parsed event data items exist for the log source is performed based on the device support module associated with the log source being updated;
• responsive to one or more unsuccessfully parsed event data items existing, reparse each unsuccessfully parsed event data item of the one or more unsuccessfully parsed event data items using an updated device support module associated with the log source;
• and
• responsive to the device support module failing to successfully reparse the unsuccessfully parsed event data item, retain the unsuccessfully parsed event data item in an unsuccessfully parsed event data item data structure.