We are using syslog-ng on an AIX system as the collection point for a large
network of IBM, Sun, and "communication device" systems. In addition to
logging the received messages, syslog-ng forwards all messages on to named
pipes which are monitored by a daemon whose task it is to "real-time" watch
for "configurable" activity. (e.g.: "connection refused" messages from a
single external system occurring on multiple of our systems, etc.) All of
this is working just fine.
We have one Sun server which acts as the focus for message from our CISCO
routers. That server forwards its messages on to our central syslog-ng
server. We now want to watch for failure condition messages from those
communication devices, making use of the daemon already in place. What
we're faced with though is the stripping of the original source detail when
the Sun box's syslogd forwards the message.
As example of what we're facing, please see below the source substitution
performed by syslogd on the forward.
The original message (obviously with a bogus hostname) as logged on
the Sun server is:
Sep 11 09:42:01 dddd.ddd.ddd.ddd 2939: Sep 11 09:41:59 EDT:
%LINK-4-ERROR: FastEthernet0/7 is experiencing errors
While that received by syslog-ng in the AIX system is:
Sep 11 09:40:57 ssss.sss.sss.sss 2939: Sep 11 09:41:59 EDT:
%LINK-4-ERROR: FastEthernet0/7 is experiencing errors
My question is this: Is there a way to configure syslogd or syslog-ng so
that the entire original message is forwarded?
Thanks in advance!
John
---
John A. Parker Senior Programmer/Analyst - AIX Cornell University
jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)