<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Unable to set PRIORITY and LEVEL in rewrite</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi,<BR>
<BR>
with the central logging of syslog in place, I moved on to the file /var/log/httpd/ssl_error_log to explore the syslog-ng (3.0.2-1 OSE on CentOS 5.3) capabilities with logfiles from other applications. The contents of this file are rather straightforward:<BR>
<BR>
[Wed Jun 24 12:14:49 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)<BR>
[Wed Jun 24 12:14:49 2009] [error] [client 192.168.3.178] PHP Notice: Undefined offset: 2<BR>
<BR>
I want to skip the date/time (assuming there is no delay before syslog-ng processes the data) and to set the PRIORITY and LEVEL attributes to "warning" and "err". The following config file (included in the main config) should do the job.<BR>
<BR>
source s_http_ssl_error {<BR>
file ( "/var/log/httpd/ssl_error_log"<BR>
flags(no-parse)<BR>
follow_freq(1)<BR>
);<BR>
};<BR>
<BR>
# Split the message.<BR>
parser p_http_ssl_error {<BR>
csv-parser(<BR>
columns( "HTTP.TIMESTAMP",<BR>
"HTTP.SEVERITY",<BR>
"HTTP.MSG" # Match the remainder of the message (greedy).<BR>
)<BR>
delimiters( " " )<BR>
flags( greedy, escape-double-char, strip-whitespace )<BR>
quote-pairs( '""[]' )<BR>
);<BR>
};<BR>
<BR>
filter f_http_ssl_error_warn{ match( "warn" value( "HTTP.SEVERITY" ) ); };<BR>
rewrite r_http_ssl_error_warn{<BR>
set( "warning" value( "LEVEL" ) );<BR>
set( "warning" value( "PRIORITY" ) );<BR>
};<BR>
<BR>
filter f_http_ssl_error_error{ match( "error" value( "HTTP.SEVERITY" ) ); };<BR>
rewrite r_http_ssl_error_error{<BR>
set( "err" value( "LEVEL" ) );<BR>
set( "err" value( "PRIORITY" ) );<BR>
};<BR>
<BR>
# Eliminate the severity as soon as PRIORITY and LEVEL are set!<BR>
# Set the attribute program to "http_ssl_error".<BR>
template t_http_ssl_error{ template( "http_ssl_error ${HTTP.SEVERITY} ${HTTP.MSG}\n" ); };<BR>
<BR>
# Send the message to the regular syslog in order to transfer it to the syslog-ng collector.<BR>
destination d_http_ssl_error{<BR>
unix-dgram( "/dev/log"<BR>
template( t_http_ssl_error )<BR>
);<BR>
};<BR>
<BR>
# Handle the warnings.<BR>
log {<BR>
source( s_http_ssl_error );<BR>
parser( p_http_ssl_error );<BR>
filter( f_http_ssl_error_warn );<BR>
rewrite( r_http_ssl_error_warn );<BR>
destination( d_http_ssl_error );<BR>
flags( final );<BR>
};<BR>
<BR>
# Handle the errors.<BR>
log {<BR>
source( s_http_ssl_error );<BR>
parser( p_http_ssl_error );<BR>
filter( f_http_ssl_error_error );<BR>
rewrite( r_http_ssl_error_error );<BR>
destination( d_http_ssl_error );<BR>
flags( final );<BR>
};<BR>
<BR>
# Handle the other messages.<BR>
log {<BR>
source( s_http_ssl_error );<BR>
parser( p_http_ssl_error );<BR>
destination( d_http_ssl_error );<BR>
};<BR>
<BR>
<BR>
Inserting [warn], [error] and [other] lines in the logfile, results in the proper number of syslog-ng messages with the desired MSG-contents. However, the priority and level attributes are unchanged ("notice"). What is wrong?<BR>
<BR>
kind regards,<BR>
<BR>
Siem Korteweg</FONT>
</P>
</BODY>
</HTML>