I'm trying to enhance the Universal Collector that is gathering data
from a Debian box using rsyslog that is forwarding everything to
Sentinel 7.2.

I'm trying to add support for OpenVPN.

My question is, when I have a method like this in custom.js:

Record.prototype["parse-ovpn"] = function(message, e) {
//log("Inside parse-ovpn", 5);
e.ProductName = "OpenVPN";

// this.evt = "TEST";
this.s_AppId = "ovpn";
e.EventName = "Test";
return true;


Should I use this.evt = "TEST";

or should I use e.EventName = "TEST";

Which one is better and why?

One thing I noticed is that if I use this.evt = "TEST" then the
EventName in Sentinel becomes "ovpn: TEST".

If I use e.EventName = "TEST" then the EventName in Sentinel becomes
just "TEST".