Hello Pallagi,

Thank you for the prompt response, very appreciated.
Im running syslog at the client side and syslog-ng at the server side.
  

Currently I have setup both and Im getting the following prefix into the log file on my syslog-ng server (this log is generated from apache on my client server),

"logger: XXX.XXX.XXX.XXX - - [26/Nov/2009:11:11:36 -0600] \"GET... "

The issue is how can I configure syslog-ng to remove the "logger:" prefix when logging.
Basically I just want a clean log same way like if I had an access_log file configured on apache on the client.
  

Thank you in advance.

--- On Thu, 11/26/09, Pallagi Zoltán <pzolee@balabit.hu> wrote:

  

From: Pallagi Zoltán <pzolee@balabit.hu>
Subject: Re: [syslog-ng] filter logger tags from syslog
To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu>, josesan311@yahoo.com
Date: Thursday, November 26, 2009, 6:40 AM



  
  

 
Hi Jose,



Jose Sanchez írta:

  Hello,

I've been using classic syslog for centralizing apache
access logs from one server to a remote syslog server, the
thing is syslog adds some nasty tags before the lines in the
access logs and I cant get them off, ie:

"Nov 25 21:25:37 server1 logger:"

I would like to know if syslog-ng has the option to filter
this kind of stuff, I just want to have the logs sent to the
syslog server exactly like I was saving them in a local
access.log file.
  

I don't understand you completely where you use
syslog or syslog-ng on these hosts



If you use syslog-ng then yes the syslog-ng can do it.
There is an
example of the possible solutions if both sides are
syslog-ng:



client side:



source s_file{file("/var/log/apache2/access.log"

flags(no-parse)

);};



destination d_tcp{tcp("10.30.0.32" port(666)

template("$MSG\n")

);};



log {

source(s_file);

destination(d_tcp);

};





server side:

source s_tcp{tcp(port(666)

flags(no-parse)

);};



destination d_test { file("/var/log/test.log"

template("$MSG\n")

); };



log {

source (s_tcp);

destination(d_test);

};





if you use syslogd on client side and syslog-ng on the
server side you
need to use a config like this (but I am not sure in this
case):



source s_tcp{udp(port(514));};



destination d_test { file("/var/log/test.log"

template("$MSG\n")

); };



log {

source (s_tcp);

destination(d_test);

};






  
Thanks in advance.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html


  



 


    

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html