Hello List,<br><br>I'm using the syslog-ng OSE version 3.1.2.<br><br>Currently,
I have a syslog-ng server which collects events from several devices :
routers (Cisco), switches (Alcatel), other devices which send events to
the syslog server by using the port 514 with the protocol UDP.<br>
<br>For the router and the switch, I need to use the flag "no-parse" because
I have to parse the content of the message by using "patterndb.xml".<br>
But... for the others devices I don't want to use the flag "no-parse" because the events respect the syslog format.<br>
<br>
I think it's not possible to configure syslog-ng like this :<br>
source s_udp_01 { udp (flags(no-parse); };<br>
source s_udp_02 { udp (); };<br><br> log { source (s_udp_01); (...) };<br> log { source (s_udp_02); (...) };<br>
<br>
The workaround could be the modification of udp port destination for the
devices but it's not possible for the switch Alcatel. For the router
Cisco, I don't know if it's possible or not...<br>
<br>Someone would have an idea for that "problem" ?<br>
<br>
Regards,<br>
<br>
Yann I.<br>