<p>On Mon, 2007-05-21 at 09:23 -0500, Ivey, Chris wrote:<br>> As I was discussing this issue with a colleague this AM, the question<br>> arose as to whether or not the restamping of messages from syslog-ng<br>> can be turned on and off for selected destinations, or if that was a
<br>> global option. Anyone know?</p>
<div>If you can provide an example of the following we can provide some recommendations:</div>
<div> </div>
<div>1. Original syslog message </div>
<div>2. Current forwarded syslog message (received by ArcSight)</div>
<div>3. Desired forwarded syslog message (the format ArcSight requires)</div>
<div>4. Your syslog-ng.conf (remove any IP's or other private info)</div>
<div> </div>
<div>Should be easy to solve either with templates or modifying syslog-ng options. Also let us know if there are multiple syslog-ng servers involved (e.g. Unix server forwarding to centralized syslog-ng server forwarding to ArcSight).
</div>