BoOnSiOnG wrote: 
Hi,

Thank you very much, now it works.

another question, by using the same source

source s_tomcat_catalina {
 		file("/srv/tomcat/logs/catalina.out" flags(no-parse)
 				default-facility(local3) default-priority(info));
};

if i forward to central loghost via TCP

my config,

destination ds_forward_catalina { tcp("192.168.203.13",
template("$MESSAGE\n")); };

it seems doesn't work, no logs forwarded to the loghost.

There is no given port number, are you sure that the syslog-ng of server side is listening on tcp port 514?
Also, if syslog-ng has already sent these logs to the server previously and there is no new log, you have to remove $syslog-ng-dir/var/syslog-ng.persist file to resend them.

You can also check the debug output of syslog-ng:
just start both syslog-ng in debug mode and you may see the problem: syslog-ng -Fevd
On Tue, Mar 30, 2010 at 4:03 PM, Zoltán Pallagi <pzolee@balabit.hu> wrote:
  
Hi,

BoOnSiOnG wrote:

Hi,

my current config,

source s_tomcat_catalina {
		file("/srv/tomcat/logs/catalina.out"
				default-facility(local3) default-priority(info));
};


In this case, syslog-ng will try to parse every line as a BSD style message
from this file (but they aren't).
Use the flags(no-parse) option:

source s_tomcat_catalina {
		file("/srv/tomcat/logs/catalina.out" flags(no-parse)
				default-facility(local3) default-priority(info));
};


destination df_local3.info {
		file("/var/log/apache2/tomcat_catalina_log", template("$MESSAGE\n"));
};

original log
Mar 30, 2010 3:26:26 AM org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8009
Mar 30, 2010 3:26:26 AM org.apache.jk.server.JkMain start
INFO: Jk running ID=0 time=0/15  config=null
Mar 30, 2010 3:26:26 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 439 ms

the output for tomcat_catalina_out
30, 2010 3:26:26 AM org.apache.jk.common.ChannelSocket init
JK: ajp13 listening on /0.0.0.0:8009
30, 2010 3:26:26 AM org.apache.jk.server.JkMain start
Jk running ID=0 time=0/15  config=null
30, 2010 3:26:26 AM org.apache.catalina.startup.Catalina start
Server startup in 439 ms

Some part of the message was missing, any idea why?

Thanks again.

On Tue, Mar 30, 2010 at 2:58 PM, Alan McKinnon <Alan.McKinnon@is.co.za>
wrote:


Use a template and $MESSAGE in the destination.

destination d_tomcat_catalina {
 file("/path/to/destination/file",
 template("$MESSAGE\n") );
};




On Tuesday 30 March 2010 08:52:33 BoOnSiOnG wrote:


Hello all,

Good day, I have configure syslog-ng to checks catalina.out every
second, but syslog-ng will append date time and machine name to the
log, I would like to know is it possible to configure syslog-ng do not
alter the original log?

my config,

source s_tomcat_catalina {
               file("/srv/tomcat/logs/catalina.out"
                               default-facility(local3)
default-priority(info)); };


log output,
Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM
org.apache.coyote.http11.Http11Protocol start
Mar 29 21:43:38 forward INFO: Starting Coyote HTTP/1.1 on http-8080
Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM
org.apache.jk.common.ChannelSocket init
Mar 29 21:43:38 forward INFO: JK: ajp13 listening on /0.0.0.0:8009
Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM
org.apache.jk.server.JkMain start
Mar 29 21:43:38 forward INFO: Jk running ID=0 time=0/14  config=null
Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM
org.apache.catalina.startup.Catalina start
Mar 29 21:43:38 forward INFO: Server startup in 428 ms

Thanks. :)
___________________________________________________________________________
___ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng FAQ:
http://www.campin.net/syslog-ng/faq.html


--
Alan McKinnon
Systems Engineer^W Technician
Infrastructure Services
Internet Solutions

+27 11 575 7585

Please note: This email and its content are subject to the disclaimer as
displayed at the following link
http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm.
Should you not have Web access, send a mail to disclaimers@is.co.za and a
copy will be emailed to you.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html




______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html




--
pzolee

    
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html


  


-- 
pzolee