<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div>Thanks for the information. I have another issue that has come up relating to the PROGRAM macro.</div><div><br></div><div><!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:AllowPNG/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:View>Normal</w:View>
<w:Zoom>0</w:Zoom>
<w:TrackMoves/>
<w:TrackFormatting/>
<w:PunctuationKerning/>
<w:ValidateAgainstSchemas/>
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
<w:DoNotPromoteQF/>
<w:LidThemeOther>EN-US</w:LidThemeOther>
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
<w:Compatibility>
<w:BreakWrappedTables/>
<w:SnapToGridInCell/>
<w:WrapTextWithPunct/>
<w:UseAsianBreakRules/>
<w:DontGrowAutofit/>
<w:SplitPgBreakAndParaMark/>
<w:EnableOpenTypeKerning/>
<w:DontFlipMirrorIndents/>
<w:OverrideTableStyleHps/>
</w:Compatibility>
<m:mathPr>
<m:mathFont m:val="Cambria Math"/>
<m:brkBin m:val="before"/>
<m:brkBinSub m:val="--"/>
<m:smallFrac m:val="off"/>
<m:dispDef/>
<m:lMargin m:val="0"/>
<m:rMargin m:val="0"/>
<m:defJc m:val="centerGroup"/>
<m:wrapIndent m:val="1440"/>
<m:intLim m:val="subSup"/>
<m:naryLim m:val="undOvr"/>
</m:mathPr></w:WordDocument>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true"
DefSemiHidden="true" DefQFormat="false" DefPriority="99"
LatentStyleCount="267">
<w:LsdException Locked="false" Priority="0" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Normal"/>
<w:LsdException Locked="false" Priority="9" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="heading 1"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/>
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/>
<w:LsdException Locked="false" Priority="39" Name="toc 1"/>
<w:LsdException Locked="false" Priority="39" Name="toc 2"/>
<w:LsdException Locked="false" Priority="39" Name="toc 3"/>
<w:LsdException Locked="false" Priority="39" Name="toc 4"/>
<w:LsdException Locked="false" Priority="39" Name="toc 5"/>
<w:LsdException Locked="false" Priority="39" Name="toc 6"/>
<w:LsdException Locked="false" Priority="39" Name="toc 7"/>
<w:LsdException Locked="false" Priority="39" Name="toc 8"/>
<w:LsdException Locked="false" Priority="39" Name="toc 9"/>
<w:LsdException Locked="false" Priority="35" QFormat="true" Name="caption"/>
<w:LsdException Locked="false" Priority="10" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Title"/>
<w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/>
<w:LsdException Locked="false" Priority="11" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/>
<w:LsdException Locked="false" Priority="22" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Strong"/>
<w:LsdException Locked="false" Priority="20" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/>
<w:LsdException Locked="false" Priority="59" SemiHidden="false"
UnhideWhenUsed="false" Name="Table Grid"/>
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/>
<w:LsdException Locked="false" Priority="1" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 1"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 1"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 1"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/>
<w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/>
<w:LsdException Locked="false" Priority="34" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/>
<w:LsdException Locked="false" Priority="29" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Quote"/>
<w:LsdException Locked="false" Priority="30" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 1"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 1"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 2"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 2"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 2"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 2"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 2"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 3"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 3"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 3"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 3"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 3"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 4"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 4"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 4"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 4"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 4"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 5"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 5"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 5"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 5"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 5"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/>
<w:LsdException Locked="false" Priority="60" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Shading Accent 6"/>
<w:LsdException Locked="false" Priority="61" SemiHidden="false"
UnhideWhenUsed="false" Name="Light List Accent 6"/>
<w:LsdException Locked="false" Priority="62" SemiHidden="false"
UnhideWhenUsed="false" Name="Light Grid Accent 6"/>
<w:LsdException Locked="false" Priority="63" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/>
<w:LsdException Locked="false" Priority="64" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/>
<w:LsdException Locked="false" Priority="65" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/>
<w:LsdException Locked="false" Priority="66" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/>
<w:LsdException Locked="false" Priority="67" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/>
<w:LsdException Locked="false" Priority="68" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/>
<w:LsdException Locked="false" Priority="69" SemiHidden="false"
UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/>
<w:LsdException Locked="false" Priority="70" SemiHidden="false"
UnhideWhenUsed="false" Name="Dark List Accent 6"/>
<w:LsdException Locked="false" Priority="71" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/>
<w:LsdException Locked="false" Priority="72" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful List Accent 6"/>
<w:LsdException Locked="false" Priority="73" SemiHidden="false"
UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/>
<w:LsdException Locked="false" Priority="19" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/>
<w:LsdException Locked="false" Priority="21" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/>
<w:LsdException Locked="false" Priority="31" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/>
<w:LsdException Locked="false" Priority="32" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/>
<w:LsdException Locked="false" Priority="33" SemiHidden="false"
UnhideWhenUsed="false" QFormat="true" Name="Book Title"/>
<w:LsdException Locked="false" Priority="37" Name="Bibliography"/>
<w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/>
</w:LatentStyles>
</xml><![endif]--><!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
</style>
<![endif]-->
</div><div id="yui_3_16_0_ym19_1_1487780274358_3747"><b style="mso-bidi-font-weight:normal" id="yui_3_16_0_ym19_1_1487780274358_3748">When I configure it
like this, the PROGRAM macro works properly and gets the proper tag from the
client:</b></div>
<div style="text-align:center" id="yui_3_16_0_ym19_1_1487780274358_3749" align="center">
<hr id="yui_3_16_0_ym19_1_1487780274358_3750" size="2" width="100%" align="center">
</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3751">source s_syslog-ports {</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3752"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3753"> </span># Configure
the network() driver for receiving RFC3164 logs</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3754"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3755">
</span>network(transport("udp") ip(10.25.10.52) port(514));</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3756"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3757">
</span>network(transport("tcp") ip(10.25.10.52) port(514)
max-connections(100));</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3758"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3759">
</span>network(transport("tcp") ip(10.25.10.52) port(1514)
max-connections(100));</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3760">};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3761"> </div>
<div id="yui_3_16_0_ym19_1_1487780274358_3762">filter f_Linux-centos {
in-list("/etc/syslog-ng/filter/Linux-centos.txt",
value("SOURCEIP")); };</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3763">destination d_Linux-centos
{file("/var/log/IT/server/Linux/CentOS/${SOURCEIP}/${SOURCEIP}[${PROGRAM}]-${YEAR}${MONTH}${DAY}.log"
template(t_message-only));};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3764">log {source(s_syslog-ports); filter(f_Linux-centos);
destination(d_Linux-centos);};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3765"> </div>
<div id="yui_3_16_0_ym19_1_1487780274358_3766"> </div>
<div id="yui_3_16_0_ym19_1_1487780274358_3767"><b style="mso-bidi-font-weight:normal" id="yui_3_16_0_ym19_1_1487780274358_3768">Then, when I change
the configuration to this, the PROGRAM macro no longer gets the same proper tag
value from the client:</b></div>
<div style="text-align:center" id="yui_3_16_0_ym19_1_1487780274358_3769" align="center">
<hr id="yui_3_16_0_ym19_1_1487780274358_3770" size="2" width="100%" align="center">
</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3771">source s_syslog-ports {</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3772"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3773"> </span># Configure
the network() driver for receiving RFC3164 logs</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3774"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3775">
</span>network(transport("udp") ip(10.25.10.52) port(514));</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3776"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3777">
</span>network(transport("tcp") ip(10.25.10.52) port(514)
max-connections(100));</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3778"><span style="mso-spacerun:yes" id="yui_3_16_0_ym19_1_1487780274358_3779">
</span>network(transport("tcp") ip(10.25.10.52) port(1514)
max-connections(100) <b style="mso-bidi-font-weight:normal" id="yui_3_16_0_ym19_1_1487780274358_3780">flags(no-parse)</b>);</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3781">};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3782"> </div>
<div id="yui_3_16_0_ym19_1_1487780274358_3783">filter f_Linux-centos {
in-list("/etc/syslog-ng/filter/Linux-centos.txt",
value("SOURCEIP")); };</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3784">destination d_Linux-centos
{file("/var/log/IT/server/Linux/CentOS/${SOURCEIP}/${SOURCEIP}[${PROGRAM}]-${YEAR}${MONTH}${DAY}.log"
template(t_message-only));};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3785">log {source(s_syslog-ports); <b style="mso-bidi-font-weight:normal" id="yui_3_16_0_ym19_1_1487780274358_3786">junction { channel {</b> filter(f_Linux-centos); <b style="mso-bidi-font-weight:normal" id="yui_3_16_0_ym19_1_1487780274358_3787">parser { syslog-parser(); }; flags(final); }; };</b>
destination(d_Linux-centos);};</div>
<div id="yui_3_16_0_ym19_1_1487780274358_3574"><span><br></span></div><div><span>Is there a way to configure the no-parse and junction option while still getting the correct PROGRAM macro data?</span></div><div><span><br></span></div><div><span>Thanks.<br></span></div><div><span></span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Wednesday, February 22, 2017 8:04 AM, "Fekete, Róbert" <robert.fekete@balabit.com> wrote:<br></font></div> <br><br> <div class="y_msg_container"><div id="yiv9949162300"><div><div dir="ltr">Hi, <div><br clear="none"></div><div>To achieve something like that, you have to use junctions. </div><div>You'll have one source with flags(no-parse), then embed a filter+parser junction to process regular syslog messages, and another junction to process the ones you cannot parse.</div><div><br clear="none"></div><div>For details, see the 8.3 example at <a rel="nofollow" shape="rect" target="_blank" href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/junctions.html">https://www.balabit.com/ documents/syslog-ng-ose- latest-guides/en/syslog-ng- ose-guide-admin/html/ junctions.html</a> and <a rel="nofollow" shape="rect" target="_blank" href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/parser-syslog.html">https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/parser-syslog.html</a></div><div><br clear="none"></div><div>HTH, </div><div><br clear="none"></div><div>Robert</div></div><div class="yiv9949162300gmail_extra"><br clear="none"><div class="yiv9949162300gmail_quote">On Wed, Feb 22, 2017 at 2:45 PM, 'Miah Lang' via SYSLOG-NG <span dir="ltr"><<a rel="nofollow" shape="rect" ymailto="mailto:syslog-ng@balabit.com" target="_blank" href="mailto:syslog-ng@balabit.com">syslog-ng@balabit.com</a>></span> wrote:<br clear="none"><blockquote class="yiv9949162300gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="yiv9949162300yqt0262501372" id="yiv9949162300yqt79278"><div><div><br clear="none"></div><blockquote type="cite">
<div class="yiv9949162300m_-4684994580070735645WordSection1">
<div class="yiv9949162300MsoNormal">Is it possible to configure multiple sources, one with flags(no-parse) and one without?<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">e.g.<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">source <b>s_syslog-ports</b> {<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> udp(port(514));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> tcp(port(1514) max-connections(100));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> tcp(port(514) max-connections(100));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">source <b>s_syslog_np-ports </b>{<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> udp(port(514) flags(no-parse));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> tcp(port(1514) max-connections(100) flags(no-parse));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> tcp(port(514) max-connections(100) flags(no-parse));<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">filter f_Cisco-router { in-list("/etc/syslog-ng/ filter/Cisco-router.txt", value("SOURCEIP")); };<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">destination d_Cisco-router {file("/var/log/IT/network/ router/cisco/${SOURCEIP}/${ SOURCEIP}-${YEAR}${MONTH}${ DAY}.log" template(t_message-only));};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">log {source(<b>s_syslog-ports</b>); filter(f_Cisco-router); destination(d_Cisco-router);};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">filter f_Cisco-switch { in-list("/etc/syslog-ng/ filter/Cisco-switch.txt", value("SOURCEIP")); };<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">destination d_Cisco-switch {file("/var/log/IT/network/ switch/cisco/${SOURCEIP}/${ SOURCEIP}-${YEAR}${MONTH}${ DAY}.log" template(t_message-only));};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">log {source(<b>s_syslog_np-ports</b>); filter(f_Cisco-switch); destination(d_Cisco-switch);};<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"> <u></u><u></u></div>
<div class="yiv9949162300MsoNormal">Whenever I do this, I get an error message when restarting the service.<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">“Job for syslog-ng.service failed because the control process exited with error code. See "systemctl status syslog-ng.service" and "journalctl -xe" for details.”
<u></u><u></u></div>
<div class="yiv9949162300MsoNormal">“Cannot add dependency job for unit microcode.service, ignoring: Unit is not loaded properly: Invalid argument.”<u></u><u></u></div>
<div class="yiv9949162300MsoNormal"><span style="color:rgb(64,64,64);font-size:10pt;font-family:Calibri, sans-serif;"> </span></div>
</div>
</blockquote></div></div><br clear="none">______________________________ ______________________________ __________________<br clear="none">
Member info: <a rel="nofollow" shape="rect" target="_blank" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/ mailman/listinfo/syslog-ng</a><br clear="none">
Documentation: <a rel="nofollow" shape="rect" target="_blank" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/ support/documentation/? product=syslog-ng</a><br clear="none">
FAQ: <a rel="nofollow" shape="rect" target="_blank" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/ syslog-ng-faq</a><br clear="none">
<br clear="none">
<br clear="none"></blockquote></div><br clear="none"></div></div></div><br><div class="yqt0262501372" id="yqt93846">______________________________________________________________________________<br clear="none">Member info: <a shape="rect" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br clear="none">Documentation: <a shape="rect" href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br clear="none">FAQ: <a shape="rect" href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>