<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.34">
<TITLE>Change the facility or the priority of a syslog message ?</TITLE>
</HEAD>
<BODY>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Hello,</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">I'm using</FONT> <FONT SIZE=2 FACE="Arial">the syslog-ng application version 3.1.0. I would like to change the severity and/or the facility of an event</FONT><FONT SIZE=2 FACE="Arial">.</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Here is the c</FONT><FONT SIZE=2 FACE="Arial">onfiguration</FONT> <FONT SIZE=2 FACE="Arial">for this test :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">template t_format {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> template ("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC;$HOST;$FACILITY;$PRIORITY;$PROGRAM;$MSG\n");</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">source s_local_test {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> unix-stream("/dev/log");</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">destination d_test {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> file (</FONT> <FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial">/tmp/test</FONT><FONT SIZE=2 FACE="Arial">"</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> template (t_format)</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> );</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">rewrite r_rewrite_set {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> set (</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> "my_program"</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> value("PROGRAM")</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> );</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">log {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> source (s_local_test);</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> rewrite (r_rewrite_set);</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> </FONT> <FONT SIZE=2 FACE="Arial">destination (d_test);</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<BR>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">I generated a message by u</FONT><FONT SIZE=2 FACE="Arial">sing "logger" :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"># logger -i -p local0.info "Test Message : ABCDEFGHIJKLMNOPQRST ## $(date) ##"</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">=> /tmp/test:</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">2010-04-01 15:12:14;pc-dev.dom;local0;info;MY_PROGRAM;Test Message : ABCDEFGHIJKLMNOPQRST ## jeu avr 1 15:12:14 CEST 2010 ##</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Ok, I can change the PROGRAM name</FONT><FONT SIZE=2 FACE="Arial">...</FONT><FONT SIZE=2 FACE="Arial"></FONT> <FONT SIZE=2 FACE="Arial">:-)</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">...</FONT><FONT SIZE=2 FACE="Arial">So I changed the rule</FONT> <FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial">r_rewrite_set</FONT><FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial"> to modify the value</FONT><FONT SIZE=2 FACE="Arial"></FONT> <FONT SIZE=2 FACE="Arial">to</FONT> <FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial">facility</FONT><FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial"> :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">rewrite r_rewrite_set {</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> set (</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> </FONT> <FONT SIZE=2 FACE="Arial">"local4"</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> value("FACILITY")</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> );</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">};</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">And when I restarted the syslog-ng, I</FONT> <FONT SIZE=2 FACE="Arial">had</FONT><FONT SIZE=2 FACE="Arial"> the following errors :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"># /etc/init.d/syslog-ng restart</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='FACILITY'</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Restarting syslog-ng: Stopping syslog-ng: [ OK ]</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Starting syslog-ng: Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='FACILITY'</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> </FONT> <FONT SIZE=2 FACE="Arial">[ OK ]</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">I have the same error when I changed</FONT> <FONT SIZE=2 FACE="Arial">the "PRIORITY" of the rule</FONT> <FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial">r_rewrite_set</FONT><FONT SIZE=2 FACE="Arial">"</FONT><FONT SIZE=2 FACE="Arial"> :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">></FONT> <FONT SIZE=2 FACE="Arial">Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='PRIORITY'</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">I tried to send a message by using "logger" but as it written in the above error,</FONT> <FONT SIZE=2 FACE="Arial">the MESSAGE was changed</FONT><FONT SIZE=2 FACE="Arial">...</FONT><FONT SIZE=2 FACE="Arial"> :-(</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">My questions are :</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> </FONT> <FONT SIZE=2 FACE="Arial">1.</FONT> <FONT SIZE=2 FACE="Arial">Which macros are read-only ?</FONT><FONT SIZE=2 FACE="Arial"> PRIORITY, FACILITY, another ?</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> 2.</FONT> <FONT SIZE=2 FACE="Arial">Is there a way to change the</FONT> <FONT SIZE=2 FACE="Arial">facility</FONT> <FONT SIZE=2 FACE="Arial">or the</FONT><FONT SIZE=2 FACE="Arial"> priority</FONT> <FONT SIZE=2 FACE="Arial">of an event ?</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial"> 3.</FONT> <FONT SIZE=2 FACE="Arial">If not, w</FONT><FONT SIZE=2 FACE="Arial">hy can't I change the facility or the priority ?</FONT> </P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Rega</FONT><FONT SIZE=2 FACE="Arial">r</FONT><FONT SIZE=2 FACE="Arial">ds,</FONT></P>
<P ALIGN=LEFT><FONT SIZE=2 FACE="Arial">Yann</FONT></P>
</BODY>
</HTML>