<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
pre
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=PT link=blue vlink=purple>
<div class=Section1><pre><font size=2 face="Courier New"><span lang=EN-GB
style='font-size:10.0pt'>>On Mon, 2008-01-28 at 11:05 +0000, Tiago Gomes da Silva Mendo wrote:<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> Hi,<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> I have syslog-ng-premium-edition (2.1.8) on an Debian etch and<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> multiple linuxs sending syslog messages to this server, using<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> diferents PRIs.<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> The problem is with the windows agent (2.1.4). In the windows agent I<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> have an message format like this: “<182>$DATE $HOST $EVENT_SOURCE:<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> $MSG”, but at the server the received PRI is not 182. <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> At the server I get messages with the correct PRI when the syslog-ng<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> agent is restarted:<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> <o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> “Jan 28 10:57:41 10.176.25.108 LogRelay: Application started”, with<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> local6 and info, but every message I send through syslog-ng agent<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>><i><span
style='font-style:italic'> arrives at the server with user/notice (PRI 13).<o:p></o:p></span></i></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>Are you reading messages from files or you are sending out the EventLog<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>records?<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>If my assumption is true, then the difference between the LogRelay entry<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>and the other messages is that the LogRelay entry is coming from the<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>EventLog, and the others come from files, right?<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>I ask my collegue to look into this.<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>-- <o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>>Bazsi<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>You are rigth. <o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>The messages from the eventlog containers are getting to the server with the right PRI, but the ones from the files don’t.<o:p></o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'><o:p> </o:p></span></font></pre><pre><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt'>Thanks<o:p></o:p></span></font></pre>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>