<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi there, <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span lang=EN-US>As I can’t find this on the web, I’m asking
here :<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I’m receiving the IIS servers logs through
my LAN and syslog-ng writes everything to a local files, that is parsed during
the night by awstats.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>The only thing is I can’t have syslog-ng to
write raw logs to files, it absolutely has to write something (either with $MSG
or $MESSAGE). I even tried with $MSGONLY but now I get the opposite problem, it
truncates data !<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><u><span lang=EN-US>$MSG :<o:p></o:p></span></u></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>IISWebLog
0 2008-09-30 14:02:40 GET
/Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1
Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2)
http://mypublicwebsite/home/regf 200 2185<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><u><span lang=EN-US>With $MSGONLY, I’ll get :<o:p></o:p></span></u></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>02:40 GET
/Localized/fr/Images/New2/tlogo.gif - 95.35.41.243 HTTP/1.1
Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2)
http://mypublicwebsite/home/regf 200 2185<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><u><span lang=EN-US>Here is my very simple template :<o:p></o:p></span></u></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal>template t_IIS {<o:p></o:p></p>
<p class=MsoNormal>
template("$MESSAGE\n");<o:p></o:p></p>
<p class=MsoNormal> <span lang=EN-US>template_escape(no);<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>};<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><u><span lang=EN-US>Destination and filter :<o:p></o:p></span></u></p>
<p class=MsoNormal><span lang=EN-US>destination df_ mypublicwebsite _IISWebLog
{ file("/data/syslog/mypublicwebsite/IISWebLog" template(t_IIS)); };<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>filter f_ mypublicwebsite _IISWebLog
{(host("^192\.168\.117\.131$")<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>
or host("^192\.168\.117\.132$")<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>
or host("^192\.168\.117\.133$")<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>
or host("^192\.168\.117\.134$")<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>
or host("^192\.168\.117\.135$") ) and facility(local4)
and program("IISWebLog"); };<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>log { source(s_net); filter(f_
mypublicwebsite _IISWebLog); destination(df_ mypublicwebsite _IISWebLog); };<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US># uname -a<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Linux TR-ADM 2.6.18-4-amd64 #1 SMP Fri May
4 00:37:33 UTC 2007 x86_64 GNU/Linux<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Anything I’m missing ? Any help would be
greatly appreciated.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Best regards<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Steven<o:p></o:p></span></p>
</div>
</body>
</html>