<div dir="ltr"><div>Hi, Got the problem</div><div><br></div><div>I was missing a "\n" at the end of the template:</div><div><br></div><div>
<span style="font-family:monospace">template t_test { template("$(if ('${LEVEL_NUM}' == '0') '<184>1' $(if ('${LEVEL_NUM}' == '1') '<185>1' $(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' $(if ('${LEVEL_NUM}' == '5') '<189>1' $(if ('${LEVEL_NUM}' == '6') '<190>1' '<191>1' ))))))) ${ISODATE} ${HOST} ${PROGRAM} ${PID} $(if ('${MSGID}' == '') '-' '${MSGID}') $(if ('${SDATA}' == '') '-' '${SDATA}') ${MESSAGE}\n"); };
</span></div><div><br></div><div>Cheers,</div><div>Alex</div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 9, 2020 at 12:41 PM Alexandre Santos <<a href="mailto:alexandre.rosas.santos@gmail.com">alexandre.rosas.santos@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><br><div class="gmail_quote"><div dir="ltr"><div>Hi,</div><div></div><div><br></div><div>I tried to rewrite PRI but the macro is not writable:</div><div><span style="font-family:monospace">Mar 09 11:27:31 localhost syslog-ng[31986]: Error parsing rewrite expression, PRI is read-only, it cannot be changed in rewrite rules in /etc/syslog-ng/syslog-ng.conf:<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 359 };<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 360 # end of localFile: netconf-commands<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 361<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 362<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 363 # remote: test<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> rewrite r_pri{set("189", value("PRI"));};<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> ^<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 365 destination d_test_udp {<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 366 syslog("192.168.122.1" transport("udp") ip-protocol(4) port(514)<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 367 suppress(5)<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 368 disk-buffer(<br>Mar 09 11:27:31 localhost syslog-ng[31986]: 369 mem-buf-size(2097152)</span></div><div><br></div><div><span style="font-family:arial,sans-serif">I tried to use the following configuration to make a facility override local0 -> local7:</span></div><div><span style="font-family:arial,sans-serif"><br></span></div><div><span style="font-family:monospace"># remote: test<br>template t_test { template("$(if ('${LEVEL_NUM}' == '0') '<184>1' $(if ('${LEVEL_NUM}' == '1') '<185>1' $(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' $(if ('${LEVEL_NUM}' == '5') '<189>1' $(if ('${LEVEL_NUM}' == '6') '<190>1' '<191>1' ))))))) ${ISODATE} ${HOST} ${PROGRAM} ${PID} $(if ('${MSGID}' == '') '-' '${MSGID}') $(if ('${SDATA}' == '') '-' '${SDATA}') ${MESSAGE}"); };<br>destination d_test_udp {<br> network("192.168.122.1" transport("udp") ip-protocol(4) port(514)<br> template ("t_test")<br> );<br>};<br>filter f_remote_test_udp_local0 {<br> facility(local0) and level(debug .. emerg);<br>};<br>log {<br> source(s_src);<br> filter(f_remote_test_udp_local0);<br> destination(d_test_udp);<br> flags(flow-control);<br>};<br># end of remote server: test</span></div><div><br></div><div>The problem is that I get a double header in the syslog server:</div><div>Mar 9 11:41:52 127.0.0.1 root[31353] <190>1 2020-03-09T11:41:52+00:00 127.0.0.1 root 31353 - - This is a Test 6<br>Mar 9 11:41:53 127.0.0.1 root[31404] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31404 - - This is a Test 7<br>Mar 9 11:41:53 127.0.0.1 root[31448] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31448 - - This is a Test 8<br>Mar 9 11:41:54 127.0.0.1 root[31449] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31449 - - This is a Test 9<br>Mar 9 11:41:54 127.0.0.1 root[31468] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31468 - - This is a Test 10<br>Mar 9 11:41:55 127.0.0.1 root[31485] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31485 - - This is a Test 11<br>Mar 9 11:41:55 127.0.0.1 root[31526] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31526 - - This is a Test 12<br>Mar 9 11:41:55 127.0.0.1 root[31567] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31567 - - This is a Test 13</div><div><br></div><div>Can you help me?</div><div><br></div><div>Thanks and regards,</div><div>Alex<br></div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><span style="font-family:arial,sans-serif">On Mon, Jan 20, 2020 at 07:49 AM Attila Szakacs
(<span style="font-size:11pt;font-family:"Calibri",sans-serif">aszakacs</span>)
<<a href="mailto:Attila.Szakacs@oneidentity.com" target="_blank">Attila.Szakacs@oneidentity.com</a>>
<u></u>
</span>
wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">
<pre>Hi Alex,
I think ${PRI} does exactly that.
PRI
Description: The priority and facility encoded as a 2 or 3 digit decimal number as it is present in syslog messages.
Regards,
Attila
________________________________
From: syslog-ng <<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">syslog-ng-bounces at lists.balabit.hu</a>> on behalf of Alexandre Santos <<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">alexandre.rosas.santos at gmail.com</a>>
Sent: Friday, January 17, 2020 7:56 PM
To: Syslog-ng users' and developers' mailing list <<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">syslog-ng at lists.balabit.hu</a>>
Subject: [syslog-ng] facility override
CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.
Hi,
Is there a way of overriding the facility of the messages on the destination, besides using a template like:
{ template("$(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' ${HOST}\\@`HOSTIPV4` ${PROGRAM} ${PID} ${SDATA} ${MESSAGE}\n"); };
Thanks in advance,
Alex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200120/7576c3cb/attachment.html" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200120/7576c3cb/attachment.html</a>></pre>
</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 17, 2020 at 6:56 PM Alexandre Santos <<a href="mailto:alexandre.rosas.santos@gmail.com" target="_blank">alexandre.rosas.santos@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi,</div><div><br></div><div>Is there a way of overriding the facility of the messages on the destination, besides using a template like:</div><div><span style="font-family:monospace">{ template("$(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' ${HOST}\\@`HOSTIPV4` ${PROGRAM} ${PID} ${SDATA} ${MESSAGE}\n"); };</span></div><div><span style="font-family:monospace"><br></span></div><div><span style="font-family:monospace"><font face="arial,sans-serif">Thanks in advance,</font></span></div><div><span style="font-family:monospace"><font face="arial,sans-serif">Alex</font><br></span></div></div>
</blockquote></div></div>
</blockquote></div></div>
</div></div>
</blockquote></div></div>