<div dir="ltr"><div><div><div><div><div><div><div><div>You have two options:<br><br></div>1) use a dedicated port on the server for non-syslog traffic, and also use flags(no-parse) there<br><br></div>2) stick to using a standard transport, but then you should ensure that clients send a complete syslog message there.<br><br></div>Although syslog-ng (on the client) does prepend a minimal header to your apache log even without a template, it doesn't prepend a program name explicitly, thus your on-wire apache log will look like this:<br><br></div><pri>$DATE $HOST 172.27.15.149 - - [<span tabindex="0" class=""><span class="">12/Nov/2015</span></span>:08:30:59 +0000] "GET / HTTP/1.1" 200...<br><br></div><div>This is standard syslog already and if you don't have a template on the server, this would be reproduced completely. Anyway, the format above is processed by syslog-ng on the server side as as an rfc3164 message, so it will parse the IP address (172.27.15.149) as the program name (bloody heuristics), but then you omitted that with your explicit template(), as you only have ${MESSAGE} there. <br><br>So you have three options:<br></div><br></div>2.a) use template ("$MSGHDR$MSG\n") without the $DATE/$HOST macros on the server, this would restore the IP address as part of $MSGHDR<br></div>2.b) prepend an application name on the client with an explicit template<br></div>2.c) use rfc5424 transport with the syslog() driver, that should keep the $MSG intact as it has less heuristics on the server side to parse all formats.<br><div><div><div><br></div><div>I would use 2.b or 2.c myself, or 1) if you have loads of non-syslog traffic.<br></div><div><div><br>
</div></div></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Thu, Nov 12, 2015 at 11:26 AM, Sandor Geller <span dir="ltr"><<a href="mailto:sandor.geller@ericsson.com" target="_blank">sandor.geller@ericsson.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 11/12/2015 11:14 AM, Gareth Allen wrote:<br>
<br>
> The problem is I'd like to strip out the received timestamp and<br>
> hostname from the beginning of the log and only have the raw Apache<br>
> message.<br>
<br>
</span>With the no-parse flag you already disabled syslog-ng's parser so you<br>
got the raw apache log on the sending side. However to ensure that the<br>
receiver gets the message intact a protocol-compliant on-wire format<br>
must get used. You seem to use the old RFC3164 format so try<br>
<br>
template("<30> $R_ISODATE $HOST $MSG\n")<br>
<br>
of course you can change the priority, timestamp and hostname fields to<br>
whatever suits you best.<br>
<br>
hth,<br>
<br>
Sandor<br>
<div class="HOEnZb"><div class="h5">______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>