On Wed, Apr 09, 2003 at 01:52:52PM +1200, Jason Haar wrote:
Hi there
We've got a central syslog-ng server here with incoming feeds from old syslog clients (HPUX,Cisco,printers,etc) as well as TCP-based feeds from syslog-ng clients. In general it all works well.
However, there seems to be a problem with kernel messages on the localhost. The fact that they are processname=kernel appears to be lost on syslog-ng - instead of seeing:
server kern info kernel: device eth0 left promiscuous mode
I see
server kern info device eth0 left promiscuous mode
the 'kernel: ' prefix has been added by klogd and is not generated by the kernel itself. However syslog-ng has an option to generate this prefix as well: source s_kern { file("/proc/kmsg" log_prefix("kernel: ")); }; and you are done. -- Bazsi