-----Original Message-----<br>
<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu
</a><br>[mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Evan Rempel<br>Sent: Thursday, September 15, 2005 10:51 AM<br>To: Syslog-ng users' and developers' mailing list
<br>Subject: [syslog-ng] syslog-ng 1.6.8 bug: not maintaining priority<br><br><br>If I use the template option for TCP or UDP destinations, the priority<br>of a message is always user.notice.<br><br><snip><br><br>and I got the following in the /var/log/syslog-ng file
<br><br>Sep 15 10:38:51 <a href="http://cashmere.comp.uvic.ca">cashmere.comp.uvic.ca</a> user notice ftp alert From<br><a href="http://cashmere.comp.uvic.ca">cashmere.comp.uvic.ca</a>: sysprog: everything is wrong<br><br>
Notice that the udp sent message contains the original ftp.alert<br>priority, but when the message is received via UDP, the message has<br>priority user.notice.<br><br>Am I doing something wrong?<br><br>
</blockquote></div><br>
Check out the detailed syslog explanation at:<br>
<br>
<a href="http://www.campin.net/syslog-ng/syslog.html">http://www.campin.net/syslog-ng/syslog.html</a><br>
<br>
Since your message isn't "<PRI>HEADER MSG" it's being rewriten in
accordance with standard syslog practice and RFC3164. I didn't know
syslog-ng doesn't put a <PRI> field in the beginning no matter
what, but it makes sense that it wouldn't when you're specifying the
format yourself. You'll have to add it.<br>
<br>
Problem is, I don't know that you can. Going by what's on the FAQ:<br>
<pre>$TAG<br>Hex representaiton of the 32-bit priority/facility pair (see<br>/usr/include/sys/syslog.h)<br>1f</pre>
You can't use a hex number there, it needs to be decimal. I don't see a
macro that we can use to properly set the decimal <PRI> in the
beginning of a templated message. Bazsi, can you shed any light on this?<br>
<br>
BTW, I think most formatting questions can be answered by people on their own after they read that syslog explanation page.<br>