<html><body>
<p>Thank you, Sandor.<br>
<br>
I have read the syslog-ng documentation, and only found a FACILITY and PRIORITY sample in it, such as:<br>
destination hosts { file("/var/log/syslogs/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes));};<br>
<br>
but my purpose is not to log these message into a file named as FACILITY, but to include this FACILITY in my log files, for example:<br>
<tt>Jun 25 20:53:34 c890f12ec07 local6:warn|warning c890f12ec07</tt> <tt>root: sunjing test 1</tt><br>
<br>
"local6:warn" is what I wanted in the log file....could you help?<br>
<br>
<br>
<br>
<br>
<img width="16" height="16" src="cid:1__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt="Inactive hide details for "Geller, Sandor \(IT\)" <Sandor.Geller@morganstanley.com>">"Geller, Sandor \(IT\)" <Sandor.Geller@morganstanley.com><br>
<br>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td style="background-image:url(cid:2__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com); background-repeat: no-repeat; " width="40%">
<ul>
<ul>
<ul>
<ul><b><font size="2">"Geller, Sandor \(IT\)" <Sandor.Geller@morganstanley.com></font></b><font size="2"> </font><br>
<font size="2">Sent by: syslog-ng-bounces@lists.balabit.hu</font>
<p><font size="2">2008-06-30 18:11</font>
<table border="1">
<tr valign="top"><td width="168" bgcolor="#FFFFFF"><div align="center"><font size="2">Please respond to<br>
"Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu></font></div></td></tr>
</table>
</ul>
</ul>
</ul>
</ul>
</td><td width="60%">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="1%"><img width="58" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
<div align="right"><font size="2">To</font></div></td><td width="100%"><img width="1" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
<font size="2">"'Syslog-ng users' and developers' mailing list'" <syslog-ng@lists.balabit.hu></font></td></tr>
<tr valign="top"><td width="1%"><img width="58" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
<div align="right"><font size="2">cc</font></div></td><td width="100%"><img width="1" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
</td></tr>
<tr valign="top"><td width="1%"><img width="58" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
<div align="right"><font size="2">Subject</font></div></td><td width="100%"><img width="1" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""><br>
<font size="2">Re: [syslog-ng] logging facility in log file</font></td></tr>
</table>
<table border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="58"><img width="1" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""></td><td width="336"><img width="1" height="1" src="cid:3__=C7BBFEEBDFC096E28f9e8a93df938@cn.ibm.com" border="0" alt=""></td></tr>
</table>
</td></tr>
</table>
<br>
<tt>Hi,<br>
<br>
> I am using syslog-ng to do remote logging for facility of<br>
> "local6" and priority of "warn", the log server is Linux<br>
> system(SLES10 SP1), it works well with the message content,<br>
> only one problem is the keyword of "local6" is not logged in<br>
> the log file, please see the details below:<br>
> on c890mgrs4(Linux)<br>
> Jun 25 20:53:34 c890f12ec07 root: sunjing test 1<br>
> Jun 25 20:53:38 c890f12ec07 root: sunjing test 2<br>
><br>
> I did the same thing on AIX log server, while it could log<br>
> the keyword of "local6" in log file:<br>
> on c890mgrs3(AIX)<br>
> Jun 25 20:53:34 c890f12ec07 local6:warn|warning c890f12ec07<br>
> root: sunjing test 1<br>
> Jun 25 20:53:38 c890f12ec07 local6:warn|warning c890f12ec07<br>
> root: sunjing test 2<br>
><br>
> So I am guessing that I did not enable this facility logging<br>
> in syslog-ng, maybe syslog-ng has a certain configuration<br>
> that could let the "facility" logged in message file, am I<br>
> right? or could you point me to the correct method? I need<br>
> this "facility" information to develop my applications.<br>
<br>
There are macros which you could use (FACILITY, PRIORITY).<br>
Simply add a template containing these to the destination<br>
section(s). You should check the reference documentation<br>
about templates and macros.<br>
<br>
Regards,<br>
<br>
Sandor<br>
--------------------------------------------------------<br>
<br>
NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.<br>
______________________________________________________________________________<br>
Member info: </tt><tt><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a></tt><tt><br>
Documentation: </tt><tt><a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a></tt><tt><br>
FAQ: </tt><tt><a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a></tt><tt><br>
<br>
</tt><br>
</body></html>