Thanks for the replies.<br><br>To address a few of the questions:<br><br>1) the receiving end is a splunk instance<br>2) I have verified the existence of the <number> with tcpdump, so its not the receiving end injecting the value.
<br>3) The logs been written locally by syslog-ng do NOT have the number injected<br>4) The template didn't seem to fix the problem<br>5) This also happens when using the program() destination<br><br>Bellow are some details regarding the 2 tests I've ran. The numbers do change but not very quickly. I haven't been able to tell if they increment or decrement or are just random.
<br><br>Quite perplexing. I think my next steps will be to recreate this issue on a totally separate node and installation of syslog-ng.<br><br><br>-Allen<br><br><br><br><br>----- details regarding the upd forwarder-------------
<br>Bellow is the destination clause in its entirety with addresses changed to protect the innocent.<br>I've tried it with and without the NGTOKEN literal just to prove to myself that the number was not part of any of the macros.
<br><br>destination forwardHost {<br> tcp("<a href="http://1.1.1.1">1.1.1.1</a>" port(1) template("NGTOKEN $ISODATE $FACILITY $LEVEL $MSG\n"));<br>};<br><br>Just to sanity check this again, I setup a filter to match local1 traffic and forward it while doing a packet capture from the syslog host using tcpdump in ASCII mode:
<br><br>13:48:16.736077 IP syslogngHost.47468 > 1.1.1.1.1: P 3847271716:3847271778(62) ack 4053481885 win 5840 <nop,nop,timestamp 11894280 1181945548><br>E..r4+@.@..)<br>.<br>.<br>. ).l'..P.$..9.....C......
<br>..~.Fs..<b><142>NGTOKEN 2007-12-20T13:48:16-0700 local1 info allen: test</b><br><br>13:48:16.736572 IP nocbuild01.overstock.com.distinct32 > syslog01.se.overstock.com.47468: . ack 62 win 5792 <nop,nop,timestamp 1181966237 11894280>
<br>E..4X{@.8...<br>. )<br>.<br>.'..l..9..P.b....l......<br><br><br><br>------------- details regarding the program() forwarder -----------------<br><br><br>my program consists of:<br>#!/usr/bin/perl<br>while(<STDIN>)
<br>{ <br> $line = $_;<br> open(F,">>/tmp/loggerOutput") or die "no open: $!";<br> print F $line . "\n";<br> close(F); <br>}<br><br>Running some quick logger tests<br><br><142>Dec 20 13:59:38 alshost allen: test
<br><br><142>Dec 20 13:59:40 alshost allen: test<br><br><142>Dec 20 13:59:40 alshost allen: test2<br><br><142>Dec 20 13:59:42 alshost allen: test3<br><br><br><br><br><br><br><br><br><br><br><div class="gmail_quote">
On Dec 20, 2007 11:16 AM, Eli Stair <<a href="mailto:estair@ilm.com">estair@ilm.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>Hey Allen,<br><br>I'd say that if you /are/ seeing '38' (or anything over 23) as a number<br>pre-pended, it's not the facility which was my first guess. Could be reporting<br>PID or other internal identifier of the sender, which some devices I see seem
<br>to use. Just speculation.. Does the number change, if so how?<br><br>To verify that's actually being /sent/ by the syslog-ng forwarder, check the<br>output when logging to a local file as well as the remote forward using the
<br>same src:template, and see if it shows up in both, as well look at the packets<br>as they hit the wire and see if it's in the payload. If it IS being sent by<br>your relay, also verify that it isn't actually in the payload sent by your log
<br>client. Can you post the template/src/dest stanzas if you find it IS being<br>generated by the syslog-ng relay?<br><br>There's obvious likelihood that it's not syslog-ng on the sending host in<br>question, but at the receiving end or originating sender adding this.
<br><br>/eli<br><div class="Ih2E3d"><br><br><br>Allen Bettilyon wrote:<br>> Hello,<br>><br>> I'm doing some pretty basic syslog forwarding using syslog-ng 1.6.2.<br>><br>> Essentially, I've got the following:
<br>><br>> destination remoteHost {<br></div>> tcp("<a href="http://1.1.1.1" target="_blank">1.1.1.1</a> <<a href="http://1.1.1.1" target="_blank">http://1.1.1.1</a>> port 9999");<br><div class="Ih2E3d">
> };<br>><br>><br>> The forwarding is working correctly, however on the remote side all my<br>> log lines are prepended with a <number> tag.<br>><br>> For example: Some log line<br>> turns into: <38>Some log line
<br>><br>> I've tried creating a custom template, but the <number> is always added<br>> to the log lines when the arrive at the remote host.<br>><br>> Why is this happening and is there a way to turn it off?
<br>><br>> Thanks,<br>><br>> - Allen Bettilyon<br>><br>><br>><br>><br>><br>><br><br></div><div><div></div><div class="Wj3C7c">_______________________________________________<br>syslog-ng maillist -
<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at
<a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br><br></div></div></blockquote></div><br>