<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Thanks for your reply, <span>János !</span></p>
<p><span><br>
</span></p>
<p><span>If you can explain me please what does that mean?</span></p>
<p><span><br>
</span></p>
<p><span></p>
<div style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;">
</div>
<div style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;">
>network(transport(tcp|udp))</div>
<div style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;">
>or</div>
<div style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;">
>syslog() or network(transport(tcp|udp) flags(syslog-protocol))</div>
<div style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;">
</div>
<br>
</span>
<p></p>
<p><span><br>
</span></p>
<p><br>
</p>
<p><span><br>
</span></p>
<p><span>======================================================================</span></p>
<p><span><br>
</span></p>
<p><span>my config:</span></p>
<p><span><br>
</span></p>
<p><span><span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 15px;"></p>
<div><br>
</div>
<div>@version: 3.18</div>
<div>@include "scl.conf"</div>
<div><br>
</div>
<div>source s_local {</div>
<div> internal();</div>
<div>};</div>
<div><br>
</div>
<div>source s_network {</div>
<div> default-network-drivers(</div>
<div> # NOTE: TLS support</div>
<div> #</div>
<div> # the default-network-drivers() source driver opens the TLS</div>
<div> # enabled ports as well, however without an actual key/cert</div>
<div> # pair they will not operate and syslog-ng would display a</div>
<div> # warning at startup.</div>
<div> #</div>
<div> #tls(key-file("/path/to/ssl-private-key") cert-file("/path/to/ssl-cert"))</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>destination d_local {</div>
<div># file("/var/log/messages");</div>
<div> file("/var/log/messages-kv_${YEAR}-${MONTH}-${DAY}.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));</div>
<div> file("/var/log/messages_${HOST}.log"</div>
<div> perm(0644)</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>destination d_logstore {</div>
<div> file(</div>
<div> "/var/log/remote/${HOST}/${HOST}_${YEAR}-${MONTH}-${DAY}.log"</div>
<div> create-dirs(yes)</div>
<div> );</div>
<div>};</div>
<div><br>
</div>
<div>log {</div>
<div> source(s_local);</div>
<div> source(s_network);</div>
<div> destination(d_local);</div>
<div> destination(d_logstore);</div>
<div># destination(d_sorted);</div>
<div>};</div>
<div><br>
</div>
</span><br>
</span>
<p></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p></p>
<div style="color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px">
<font size="2" style="font-family:Calibri,sans-serif,serif,EmojiFont"><span style="font-size:11pt"><font size="2" color="#2E74B5" style="font-family:Arial,sans-serif,serif,EmojiFont"><span style="font-size:10pt"><span style="font-size:10pt">best regards</span><span style="font-size:10pt">,</span></span></font></span></font></div>
<span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px">
<font size="2" style="font-family:Calibri,sans-serif,serif,EmojiFont"><span style="font-size:11pt"><font size="2" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:10pt"><b>Nepryahin Ivan</b></span></font></span></font></div>
<div style="color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px">
<font size="2" style="font-family:Calibri,sans-serif,serif,EmojiFont"><span style="font-size:11pt"><font size="1" color="#2E74B5" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:10pt">IT Department</span></font></span></font></div>
<span style="font-size:10pt"></span><span style="font-size:9pt"></span><span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px">
<font size="2" style="font-family:Calibri,sans-serif,serif,EmojiFont"><span style="font-size:11pt"><font size="1" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt"><b>Phone</b></span></font><font size="1" color="#0073AF" style="font-family:"Cambria Math",serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt"><b>: </b></span></font><font size="1" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt">+7
812 327 32 33</span></font></span></font></div>
<div style="color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px">
<font size="2" style="font-family:Calibri,sans-serif,serif,EmojiFont"><span style="font-size:11pt"><font size="1" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt"><b>Mobile: </b></span></font><font size="1" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt">+7 </span></font><font size="1" color="#2E74B5" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt">911
291 81 68</span></font><font size="1" color="#0073AF" style="font-family:Arial,sans-serif,serif,EmojiFont"><span lang="en-US" style="font-size:8pt"></span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of SZIGETVÁRI János <jszigetvari@gmail.com><br>
<b>Sent:</b> Thursday, March 25, 2021 6:24:09 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng has add extra field</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hello Ivan,</div>
<div><br>
</div>
<div>Most commonly there may be two main formats of logs that you may encounter.</div>
<div>One is the traditional BSD-style syslog, described in RFC 3164: <a href="https://tools.ietf.org/html/rfc3164">
https://tools.ietf.org/html/rfc3164</a></div>
<div>The other is the IETF-style log format, described in RFC 5424: <a href="https://tools.ietf.org/html/rfc5424">
https://tools.ietf.org/html/rfc5424</a></div>
<div><br>
</div>
<div>In case of syslog-ng you would have to either use</div>
<div>network(transport(tcp|udp))</div>
<div>or</div>
<div>syslog() or network(transport(tcp|udp) flags(syslog-protocol))</div>
<div>respectively.</div>
<div><br>
</div>
<div>The sample logs you included seem to resemble the IETF-style.</div>
<div>What type of source do you have configured in your syslog-ng setup? (Could you please share your config file?)</div>
<div><br>
</div>
<div>Best Regards,</div>
<div>János<br>
</div>
<div>
<div>
<div dir="ltr" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">--</div>
<div dir="ltr">Janos SZIGETVARI<br>
<span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">
150-053-692</a></span><br>
</div>
<div dir="ltr"><span><br>
</span></div>
<div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">
linkedin.com/in/janosszigetvari</a></span><br>
E-mail: <a href="mailto:janos@szigetvari.com" target="_blank">janos@szigetvari.com</a>,
<a href="mailto:jszigetvari@gmail.com" target="_blank">jszigetvari@gmail.com</a></div>
<div dir="ltr">Web: <a href="https://janos.szigetvari.com" target="_blank">janos.szigetvari.com</a><br>
<br>
__@__˚V˚<br>
Make the switch to open (source) applications, protocols, formats now:<br>
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>
- msn -> jabber protocol (Pidgin, Google Talk)<br>
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">Ivan Nepryahin - Bercut <<a href="mailto:Ivan.Nepryahin@bercut.com" target="_blank">Ivan.Nepryahin@bercut.com</a>> ezt írta (időpont: 2021. márc. 25., Cs, 14:56):<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p></p>
<div></div>
<div>Hi all!</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I think I have a stupid question, but I really dont know how this make.</div>
<div><br>
</div>
<div>Situation: </div>
<div>When I send syslog message with timestamp in format "1Mar 25 2021 16:35:49" everything works great, but when I send message with timestamp in format "1Mar 25 2021 16:35:49<b>+03:00</b>", syslog-ng adding two extra fields with timestamp and IP address
and due that break down file naming.</div>
<div><br>
</div>
<div>Question:</div>
<div>How can I say to syslog-ng server do not add extra fields when he get message with +03:00 in timestamp?</div>
<div><br>
</div>
<div>message without +03:00</div>
<div></div>
<span>Mar 25 13:11:57 HUAWEI-CORE-OFFICE-1 <bla bla bal></span>
<div><br>
</div>
<div>mesage with <span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">+03:00 </span></div>
<div><span><span>Mar 25 13:46:45 192.168.100.34 Mar 25 2021 16:46:45<b>+03:00</b> HUAWEI-CORE-OFFICE-1 </span> <bla bla bla></span><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div></div>
<span>I will be appreciate for any advice!</span><br>
<p></p>
<p><span><br>
</span></p>
<p><span><br>
</span></p>
<p><span>P.s sorry for bad english it is not my native language </span></p>
<p><br>
</p>
<p><br>
</p>
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876Signature">
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#2E74B5"><span style="font-size:10pt"><span style="font-size:10pt">best regards</span><span style="font-size:10pt">,</span></span></font></span></font></div>
<span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#0073AF"><span style="font-size:10pt" lang="en-US"><b>Nepryahin Ivan</b></span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:10pt" lang="en-US">IT Department</span></font></span></font></div>
<span style="font-size:10pt"></span><span style="font-size:9pt"></span><span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Phone</b></span></font><font style="font-family:"Cambria Math",serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7
812 327 32 33</span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Mobile: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7 </span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:8pt" lang="en-US">911
291 81 68</span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"></span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</body>
</html>