cd /opt/arcsight/connectors/; tail -f *_con1_rsyslog_paloalto_2500*/current/logs/agent.out.wrapper.log | awk '/^==> / {a=substr($0, 5, length-8); next} {print a":"$0}'
cd /opt/arcsight/connectors/; tail -f *_con1_rsyslog_paloalto_2500*/current/logs/agent.out.wrapper.log | awk '/^==> / {a=substr($0, 5, length-8); next} {print a":"$0}'