Hello,
I'm using the syslog-ng application version 3.1.0. I would like to change
the severity and/or the facility of an event.
Here is the configuration for this test :
template t_format {
template ("$YEAR-$MONTH-$DAY
$HOUR:$MIN:$SEC;$HOST;$FACILITY;$PRIORITY;$PROGRAM;$MSG\n");
};
source s_local_test {
unix-stream("/dev/log");
};
destination d_test {
file ( "/tmp/test"
template (t_format)
);
};
rewrite r_rewrite_set {
set (
"my_program"
value("PROGRAM")
);
};
log {
source (s_local_test);
rewrite (r_rewrite_set);
destination (d_test);
};
I generated a message by using "logger" :
# logger -i -p local0.info "Test Message : ABCDEFGHIJKLMNOPQRST ## $(date)
##"
=> /tmp/test:
2010-04-01 15:12:14;pc-dev.dom;local0;info;MY_PROGRAM;Test Message :
ABCDEFGHIJKLMNOPQRST ## jeu avr 1 15:12:14 CEST 2010 ##
Ok, I can change the PROGRAM name... :-)
...So I changed the rule "r_rewrite_set" to modify the value to "facility" :
rewrite r_rewrite_set {
set (
"local4"
value("FACILITY")
);
};
And when I restarted the syslog-ng, I had the following errors :
# /etc/init.d/syslog-ng restart
Macros are read-only, they cannot be changed in rewrite rules, falling back
to MESSAGE instead; macro='FACILITY'
Restarting syslog-ng: Stopping syslog-ng: [ OK ]
Starting syslog-ng: Macros are read-only, they cannot be changed in rewrite
rules, falling back to MESSAGE instead; macro='FACILITY'
[ OK ]
I have the same error when I changed the "PRIORITY" of the rule
"r_rewrite_set" :
> Macros are read-only, they cannot be changed in rewrite rules, falling
back to MESSAGE instead; macro='PRIORITY'
I tried to send a message by using "logger" but as it written in the above
error, the MESSAGE was changed... :-(
My questions are :
1. Which macros are read-only ? PRIORITY, FACILITY, another ?
2. Is there a way to change the facility or the priority of an event ?
3. If not, why can't I change the facility or the priority ?
Regards,
Yann