<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Ubuntu Mono"> Gabor,<br>
<br>
Thanks for the help!<br>
<br>
<br>
<br>
If someone else have another tip, I am all ears.<br>
<br>
<br>
Have a nice day!<br>
</font>
<div class="moz-signature">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<font face="Courier New, Courier, monospace" color="#000000">
<br>
<br>
<br>
Para contato ou solicitações utilize nosso canal de atendimento
via Suporte Técnico através<br>
de nossa central 24H via tel.:(21) 2538-8400 ou através do
email: <a class="moz-txt-link-abbreviated" href="mailto:suporte@mls.com.br">suporte@mls.com.br</a>
<br>
<br>
<br>
<br>
<br>
<font color="#7f7f7f"><font size="2">Atenciosamente,</font></font><br>
<br>
<img
src="http://www.mls.com.br/email_assinatura/assinatura_mls.jpg"
width="135" hspace="12" height="56" border="0" align="LEFT">
<font color="#202a88"><font size="2"><b>João Tiago Braz</b></font></font><font
color="#7f7f7f"><font size="2"> | Aux. Sistemas Operação</font></font><br>
<font color="#7f7f7f"><font size="2">21 2538-8400 | 21 3923-5000</font></font><br>
<font color="#7f7f7f"><font size="2"><a class="moz-txt-link-abbreviated" href="mailto:operacoes@mls.com.br">operacoes@mls.com.br</a></font></font><br>
<br>
<br>
<br>
<br>
</font></div>
<div class="moz-cite-prefix">On 03/10/2020 07:32, Nagy Gábor wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CANXW6W84V9BJWqanotOdg6_K_vEXUhTGtvbKOw1Zrz8tr8h0wA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div>Hi!</div>
<div><br>
</div>
<div>unset() rewrite rule was introduced in version 3.8.<br>
<a
href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/administration-guide/2#TOPIC-956389"
moz-do-not-send="true">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/administration-guide/2#TOPIC-956389</a></div>
<div>The strange error - Plugin module not found in
'module-path'; module-path='/lib64/syslog-ng',
module='rewrite' - can be seen because unset() is not
understood as a keyword in the configuration.</div>
<div><br>
</div>
<div>My idea to reduce the size of the output log: you can use a
template to define what should be included in the output. Or
you could configure logrotate.<br>
<br>
</div>
<div>Regards,<br>
</div>
<div>Gabor<br>
</div>
<div><br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">operacoes - mls wireless <<a
href="mailto:opertec@mls.com.br" moz-do-not-send="true">opertec@mls.com.br</a>>
ezt írta (időpont: 2020. okt. 3., Szo, 0:23):<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div> Hello there,<br>
<br>
I am runing syslog-ng 3.2.5 on a centos 6.10 server, the log
server. Here we have 30 clients sending log via rsyslog to
the log server. At the log server each one of them have its
own log according to the host name. This operation works
just fine. Now my manager ask me to remove some parts of the
log, so the final log size will be smaller. At the log
server I tried use rewrite and unset to suppress some parts
of the log but it does not work, with the error : Plugin
module not found in 'module-path';
module-path='/lib64/syslog-ng', module='rewrite'<br>
<br>
<br>
This is the config on log server for each one of the
clients.<br>
<br>
filter f_client_serv01 { host( "client_serv01" ); };<br>
destination d_client_serv01 {
file("/var/log/client_serv01.log" perm(0644) owner(root)
group(root) ); };<br>
log { source(s_net); filter(f_client_serv01);
destination(d_client_serv01); };<br>
<br>
<br>
This is the log<br>
<br>
Oct 2 19:07:04 client_serv01 kernel: IN=rdc1 OUT=
MAC=00:50:da:6f:0a:54:ec:08:6b:7f:d5:cb:08:00 SRC=10.1.16.35
DST=xxx.xxx.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=27903 DF PROTO=TCP SPT=40917 DPT=443 WINDOW=65535
RES=0x00 SYN URGP=0 <br>
<br>
<br>
rewrite r_rewrite_unset{<br>
unset(value("WINDOW"));<br>
};<br>
<br>
<br>
rewrite r_rewrite_subst{<br>
subst("WINDOW", " ", value("MESSAGE"), flags("global"));<br>
};<br>
<br>
<br>
<br>
Does anyone have a tip to try to solve this?<br>
<br>
Thanks for help.<br>
<br>
Have a nice day!<br>
<div>-- <br>
<font face="Courier New, Courier, monospace"
color="#000000"> <br>
<br>
<br>
Para contato ou solicitações utilize nosso canal de
atendimento via Suporte Técnico através<br>
de nossa central 24H via tel.:(21) 2538-8400 ou através
do email: <a href="mailto:suporte@mls.com.br"
target="_blank" moz-do-not-send="true">suporte@mls.com.br</a>
<br>
<br>
<br>
<br>
<br>
<font color="#7f7f7f"><font size="2">Atenciosamente,</font></font><br>
<br>
<img
src="http://www.mls.com.br/email_assinatura/assinatura_mls.jpg"
moz-do-not-send="true" width="135" hspace="12"
height="56" border="0" align="LEFT"> <font
color="#202a88"><font size="2"><b>João Tiago Braz</b></font></font><font
color="#7f7f7f"><font size="2"> | Aux. Sistemas
Operação</font></font><br>
<font color="#7f7f7f"><font size="2">21 2538-8400 | 21
3923-5000</font></font><br>
<font color="#7f7f7f"><font size="2"><a
href="mailto:operacoes@mls.com.br" target="_blank"
moz-do-not-send="true">operacoes@mls.com.br</a></font></font><br>
<br>
<br>
<br>
<br>
</font></div>
</div>
______________________________________________________________________________<br>
Member info: <a
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
</body>
</html>