Hello,
Hi all!
When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file.
here is an excerpt of my configuration file..
destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MO NTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); };
anybody knows why this occurs?
Where did you find USERNAME and EVENT_SOURCE referred? syslog-ng 2.0 doesn't set these. You can find every macros in src/macros.c
I've just checked the latest syslog-ng admin guide, so I'm correcting myself: these are used only by the windows agent, the unix version (at least the open source one) doesn't have support for these variables. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.