<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Bazsi/Others;<br><br>Where and how can I download the Windows agent? Or this a "Premium" only download?<br><br>Thanks,<br><br>.vp<br><br><br>> From: bazsi@balabit.hu<br>> To: syslog-ng@lists.balabit.hu<br>> Date: Mon, 28 Jan 2008 16:04:18 +0100<br>> Subject: Re: [syslog-ng] Win syslog-agent PRI<br>> <br>> <br>> On Mon, 2008-01-28 at 11:54 +0000, Tiago Gomes da Silva Mendo wrote:<br>> > >On Mon, 2008-01-28 at 11:05 +0000, Tiago Gomes da Silva Mendo wrote:<br>> > >> Hi,<br>> > >> <br>> > >> <br>> > >> <br>> > >> I have syslog-ng-premium-edition (2.1.8) on an Debian etch and<br>> > >> multiple linuxs sending syslog messages to this server, using<br>> > >> diferents PRIs.<br>> > >> <br>> > >> The problem is with the windows agent (2.1.4). In the windows agent I<br>> > >> have an message format like this: “<182>$DATE $HOST $EVENT_SOURCE:<br>> > >> $MSG”, but at the server the received PRI is not 182. <br>> > >> <br>> > >> At the server I get messages with the correct PRI when the syslog-ng<br>> > >> agent is restarted:<br>> > >> <br>> > >> <br>> > >> <br>> > >> “Jan 28 10:57:41 10.176.25.108 LogRelay: Application started”, with<br>> > >> local6 and info, but every message I send through syslog-ng agent<br>> > >> arrives at the server with user/notice (PRI 13).<br>> > > <br>> > >Are you reading messages from files or you are sending out the EventLog<br>> > >records?<br>> > > <br>> > >If my assumption is true, then the difference between the LogRelay entry<br>> > >and the other messages is that the LogRelay entry is coming from the<br>> > >EventLog, and the others come from files, right?<br>> > > <br>> > >I ask my collegue to look into this.<br>> > > <br>> <br>> I've talked to my collegue, and as it seems the 2.1.x version of the<br>> agent does not support templates for lines coming from file sources.<br>> <br>> However the upcoming 2.2 version already does, but it's not ready for<br>> public consumption yet.<br>> <br>> -- <br>> Bazsi<br><br></body>
</html>