<div dir="ltr"><div>Hello Ivan,</div><div><br></div><div>Most commonly there may be two main formats of logs that you may encounter.</div><div>One is the traditional BSD-style syslog, described in RFC 3164: <a href="https://tools.ietf.org/html/rfc3164">https://tools.ietf.org/html/rfc3164</a></div><div>The other is the IETF-style log format, described in RFC 5424: <a href="https://tools.ietf.org/html/rfc5424">https://tools.ietf.org/html/rfc5424</a></div><div><br></div><div>In case of syslog-ng you would have to either use</div><div>network(transport(tcp|udp))</div><div>or</div><div>syslog() or network(transport(tcp|udp) flags(syslog-protocol))</div><div>respectively.</div><div><br></div><div>The sample logs you included seem to resemble the IETF-style.</div><div>What type of source do you have configured in your syslog-ng setup? (Could you please share your config file?)</div><div><br></div><div>Best Regards,</div><div>János<br></div><div><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">--</div><div dir="ltr">Janos SZIGETVARI<br><span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">150-053-692</a></span><br></div><div dir="ltr"><span><br></span></div><div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">linkedin.com/in/janosszigetvari</a></span><br>E-mail: <a href="mailto:janos@szigetvari.com" target="_blank">janos@szigetvari.com</a>, <a href="mailto:jszigetvari@gmail.com" target="_blank">jszigetvari@gmail.com</a></div><div dir="ltr">Web: <a href="https://janos.szigetvari.com" target="_blank">janos.szigetvari.com</a><br><br>__@__˚V˚<br>Make the switch to open (source) applications, protocols, formats now:<br>- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>- msn -> jabber protocol (Pidgin, Google Talk)<br>- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Ivan Nepryahin - Bercut <<a href="mailto:Ivan.Nepryahin@bercut.com" target="_blank">Ivan.Nepryahin@bercut.com</a>> ezt írta (időpont: 2021. márc. 25., Cs, 14:56):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p></p>
<div></div>
<div>Hi all!</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I think I have a stupid question, but I really dont know how this make.</div>
<div><br>
</div>
<div>Situation: </div>
<div>When I send syslog message with timestamp in format "1Mar 25 2021 16:35:49" everything works great, but when I send message with timestamp in format "1Mar 25 2021 16:35:49<b>+03:00</b>", syslog-ng adding two extra fields with timestamp and IP address
and due that break down file naming.</div>
<div><br>
</div>
<div>Question:</div>
<div>How can I say to syslog-ng server do not add extra fields when he get message with +03:00 in timestamp?</div>
<div><br>
</div>
<div>message without +03:00</div>
<div></div>
<span>Mar 25 13:11:57 HUAWEI-CORE-OFFICE-1 <bla bla bal></span>
<div><br>
</div>
<div>mesage with <span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:16px">+03:00 </span></div>
<div><span><span>Mar 25 13:46:45 192.168.100.34 Mar 25 2021 16:46:45<b>+03:00</b> HUAWEI-CORE-OFFICE-1 </span> <bla bla bla></span><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div></div>
<span>I will be appreciate for any advice!</span><br>
<p></p>
<p><span><br>
</span></p>
<p><span><br>
</span></p>
<p><span>P.s sorry for bad english it is not my native language </span></p>
<p><br>
</p>
<p><br>
</p>
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876Signature">
<div id="gmail-m_4841975196670874397gmail-m_-6357573219866753876divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#2E74B5"><span style="font-size:10pt"><span style="font-size:10pt">best regards</span><span style="font-size:10pt">,</span></span></font></span></font></div>
<span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="2" color="#0073AF"><span style="font-size:10pt" lang="en-US"><b>Nepryahin Ivan</b></span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:10pt" lang="en-US">IT Department</span></font></span></font></div>
<span style="font-size:10pt"></span><span style="font-size:9pt"></span><span style="font-size:10pt"></span>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Phone</b></span></font><font style="font-family:"Cambria Math",serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7
812 327 32 33</span></font></span></font></div>
<div style="color:rgb(33,33,33);font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont;font-size:15px;margin:0px">
<font style="font-family:Calibri,sans-serif,serif,EmojiFont" size="2"><span style="font-size:11pt"><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"><b>Mobile: </b></span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US">+7 </span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#2E74B5"><span style="font-size:8pt" lang="en-US">911
291 81 68</span></font><font style="font-family:Arial,sans-serif,serif,EmojiFont" size="1" color="#0073AF"><span style="font-size:8pt" lang="en-US"></span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>