<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">You would have to use a syslog-ng
template defined as<br>
<br>
"<$PRI>$ISO_DATE $FULLHOST $MSGHDR$MESSAGE\n"<br>
<br>
and that would be the "on the wire" format. The you can netcat
this to the syslog port which would replay the log.<br>
<br>
Evan.<br>
<br>
On 09/08/2016 02:39 PM, Scot Needy wrote:<br>
</div>
<blockquote
cite="mid:B148DE0A-1A67-4D21-AD1B-36C78F23C013@gmail.com"
type="cite">
<pre wrap="">Thanks Even,
Maybe I’m doing something wrong.
I see some of the headers but not all.
2016-09-08T17:31:17-04:00 <IPADDR> <HOST> %ASA-3-305006: regular translation creation failed for imp src ….
I guess what I was looking for is something that I could write blocks of data to and read from irregardless of the type of data.
Something almost like tcpdump or buffer that could rotate every hour or so and then be used to re-play directly back into syslog-ng.
Log > YYYY.MM.DD.HH_compressed_data.
</pre>
<blockquote type="cite">
<pre wrap="">On Sep 8, 2016, at 5:13 PM, Evan Rempel <a class="moz-txt-link-rfc2396E" href="mailto:erempel@uvic.ca"><erempel@uvic.ca></a> wrote:
If you write the syslog data to a file with all of the data, then it can be ingested again.
We save the data to the files like
2016-09-08T00:00:01-07:00 host.name.here mail.info sm-mta[9521]: u887019I009521: milter=mimedefang, action=rcpt, continue
and then we have a syslog-ng pattern database that will turn this back into an "on the wiire" format that can be sent to any syslog port.
Alternatively, you could save it in the file as the original format, and then it can just be sent back to syslog when you need to. Human readablility is not quite as good, but if you have the data in splunk or whatever, then humans don't need to read the raw files.
Evan.
On 09/08/2016 01:32 PM, Scot Needy wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi All,
Is there a better way to archive my syslog data once it’s been received and injected into elk,spunk or whatever ?
I see how I can log my data to flat files using date macros then compress and archive as normal data but is there a better way to write out the data in the same format it was received to facilitate re-injesting ?
For example: My syslog data on file does not include the original syslog header data .
Syslog is just one example.
</pre>
</blockquote>
<pre wrap="">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<pre wrap="">
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
<p><br>
</p>
<pre class="moz-signature" cols="500">--
Evan Rempel <a class="moz-txt-link-abbreviated" href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>
Senior Systems Administrator 250.721.7691
Data Centre Services, University Systems, University of Victoria
</pre>
</body>
</html>