<div dir="auto">That's possibly an rfc5424 message, which you can parse using either udp(flags(syslog-protocol)) or syslog(transport(udp)) as source.<div dir="auto"><br></div><div dir="auto"><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Oct 16, 2017 17:18, "Evan Rempel" <<a href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Your syslog message is<br>
<br>
<14>1 2017-10-16T10:32:<a href="tel:15.151157" value="+3615151157" target="_blank">15.151157</a>+02:<wbr>00 my-hostname lampelogtest 54321 111111 - Test syslog message<br>
<br>
which is not a correctly formatted syslog message because the the leading "1 ". Syslog-ng will try to parse this as a data (which should be the first thing after the <##>) and since it is not a data, the entire line will be placed into the MSG macro and all of the other header fields will be populate the best they can.<br>
<br>
The date/time will be the date/time of the syslong-ng receiving host.<br>
The FULLHOST will be populated with the information from the network packet. This includes the IP address of the sender.<br>
the PROGRAM will be empty.<br>
<br>
If you look at the messages logged in '/tmp/10.3.25.4.log' you should be able to confirm this (or prove I'm out to lunch).<br>
<br>
Evan<br>
<br>
On 10/16/2017 02:23 AM, Thomas Haupt wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
I'm trying to use the hostname from inside the syslog message as filename but it doesn't work for me:<br>
<a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-macros.html#macro-fullhost" rel="noreferrer" target="_blank">https://www.balabit.com/docume<wbr>nts/syslog-ng-ose-latest-<wbr>guides/en/syslog-ng-ose-guide-<wbr>admin/html/reference-macros.<wbr>html#macro-fullhost</a><br>
<br>
my config:<br>
@version: 3.9<br>
<br>
options { keep_hostname(yes); use-dns(no); };<br>
source s_system { udp(ip("0.0.0.0") port(514)); };<br>
destination d_all { file("/tmp/${FULLHOST}.log"); };<br>
log { source(s_system); destination(d_all); };<br>
<br>
<br>
The result is my ip address instead of "my-hostname", but I expect "my-hostname":<br>
syslog-ng -Fevd<br>
....<br>
[2017-10-16T10:32:<a href="tel:15.188058" value="+3615188058" target="_blank">15.188058</a>] Incoming log entry; line='<14>1 2017-10-16T10:32:<a href="tel:15.151157" value="+3615151157" target="_blank">15.151157</a>+02:<wbr>00 my-hostname lampelogtest 54321 111111 - Test syslog message'<br>
[2017-10-16T10:32:<a href="tel:15.188327" value="+3615188327" target="_blank">15.188327</a>] Initializing destination file writer; template='/tmp/${FULLHOST}.log<wbr>', filename='/tmp/10.3.25.4.log'<br>
<br>
Some more information:<br>
<br>
syslog-ng --version<br>
syslog-ng 3.9.1<br>
Installer-Version: 3.9.1<br>
Revision:<br>
Module-Directory: /usr/lib64/syslog-ng<br>
Module-Path: /usr/lib64/syslog-ng<br>
Available-Modules: add-contextual-data,afamqp,aff<wbr>ile,afprog,afsocket,afstomp,<wbr>afuser,basicfuncs,cef,confgen,<wbr>cryptofuncs,csvparser,date,<wbr>dbparser,disk-buffer,graphite,<wbr>json-plugin,kvformat,linux-<wbr>kmsg-format,pseudofile,syslogf<wbr>ormat,system-source,tfgetent<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: on<br>
Enable-TCP-Wrapper: on<br>
Enable-Linux-Caps: off<br>
<br>
<br>
The system is a SLES11SP4<br>
<br>
<br>
Regards,<br>
Thomas <br>
</blockquote>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</blockquote></div></div>