On Fri, Sep 07, 2007 at 05:26:02PM +0800, Wilson Lai wrote:
Dear all, What happen if the log message is not a standard syslog message? Thanks.
If a Cisco switch sends a message like this: 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 ...it'll be written to disk like this: Aug 23 03:04:05 switch.company.com 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16 syslog servers put in a proper syslog formatted header. The behavior is documented here: http://www.faqs.org/rfcs/rfc3164.html It's not syslog-ng specific behavior. -- Nate "The IBM compatible sector has not yet recognized that 95% of computer usage is devoted to experimenting with different fonts and character styles in documents." - Reiner, Ron