<div dir="ltr"><div>Hi </div><div> </div><div>This is how I configured and the Final Log Message</div><div>parser p_drop_msgid {<br> csv_parser(<br> columns(<br> "dropme",<br> "EMSG"<br> )<br> delimiters("]")<br> );<br> };</div><p>parser pattern_db {<br> db_parser(<br> file("/test/syslogs/script/parser/patterndb.xml")<br> );<br> };</p><p><br>destination r_auth {<br>file("/test/syslogs/$FULLHOST_FROM/messagesAuth.$YEAR.$MONTH.$DAY.$HOUR"<br>owner(root) group(salars) perm(0640)<br>template("<#|${S_FULLDATE}|${usracct.type}|${usracct.device}|${usracct.application}|${secevt.verdict}|${EMSG}|${usracct.username}|#>\n")<br>); <br> };</p><p><br>log { source (remote); filter (f_auth); parser(p_drop_msgid); parser(pattern_db); destination (r_auth); }; </p><p>Final Log message:</p><div><#|2014 Oct 1 16:07:54|||||[ID 800047 auth.notice] Failed none for abc1234 from 100.200.300.10 port 59301 ssh2||#><br></div><div> </div><div>Thanks & Regards</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 2, 2014 at 3:26 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<span><br>
On Wed, Oct 01, 2014 at 10:48:44PM -0400, Justin Kala wrote:<br>
> my syslog-ng server (Syslog-ng OSE 3.0.4), this came default with SOLARIS<br>
> OS..<br>
> is not using patterndb.xml db_parser i configured in syslog-ng.conf. I<br>
> chopped off the message id content and the actual message is sent to<br>
> pattern-db parser but all the macro values that are referred from here are<br>
> not getting populated in the final log<br>
<br>
</span>Can you elaborate on the nature of "the final log"?<br>
If you're simply using a file destination with default template, you won't<br>
see any of the macros, as by default only $DATE, $HOST, $PROGRAM, $PID and<br>
$MSG are shown. You need to explicitly do that in the template format.<br>
<div class="HOEnZb"><div class="h5"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Kaladhar
</div>