<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">*RANT ON*<br>
<br>
cisco logging is the worst. For instance, the * at the beginning
of the line indicates that the clock on the device is not
synchronized with an external time clock. Great new cisco, but now
it is not a valid time stamp!<br>
<br>
*RANT OFF*<br>
<br>
We use a pattern database to rewrite poor logs prior to doing
anything else with the logs.<br>
There also is not a valid program name in this syslog line, so we
take the %XXXX-N-YYYY: part of the line and turn it into a program
name of cisco_XXXX<br>
<br>
One of our tansformed lines of the same kind looks like<br>
<br>
<br>
2016-06-09T07:17:23-07:00 device.hostname.domain local7.notice
cisco_LINEPROTO: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet1/0/4, changed state to up<br>
<br>
If you are interested in this contact me off-list and I can
provide the rewrite pattern database and the syslog-ng
configuration snippet that uses it.<br>
We also have rewrites for netapp, ddn disk, zone minder, Intel
True Scale switches and OpenManage Server Administrator.<br>
<br>
Evan.<br>
<br>
<br>
On 06/09/2016 02:59 AM, Nutan Shinde wrote:<br>
</div>
<blockquote
cite="mid:CADyday1ZKUQVLJErcrURi9Z=Wn-9Fq0B5rz60pmLMF-EU=jYbA@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">Hi,
<div><br>
</div>
<div>Following is the syslog message received from Cisco router
:</div>
<div><br>
</div>
<div><span style="background-color:rgb(153,153,153)">*Mar 1
09:30:25.249 UTC: %LINEPROTO-5-UPDOWN: Line protocol on
Interface Tunnel2, changed state to down</span><br>
</div>
<div><br>
</div>
<div>As, you can see UTC is included in the above timestamp.
That is why value of $PROGRAM is UTC and $MSGONLY is
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel2,
changed state to down.</div>
<div><br>
</div>
<div>What should I include in the syslog-ng.conf so that time
zone is ignored?</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
<p><br>
</p>
<pre class="moz-signature" cols="500">--
Evan Rempel</pre>
</body>
</html>