What is the $PROGRAM name? I think you're probably missing a colon after whatever is supposed to be the program. On Thu, Feb 3, 2011 at 7:11 PM, Lance Laursen <lance@demonware.net> wrote:
Hello list, I am currently trying to test structured data log messages with syslog-ng. I'm running syslog-ng-3.1.2-1.rhel5. Setup is very simple, with a udp source and a destination to /var/log/messages. Here's the line i'm trying to use to test with, which according to the RFC, should be fine: echo -n '<165>1 2011-02-03T22:14:15.003Z superhostomg process - ID47 [exampleSDID@32473 iut="9" eventSource="rawr" eventID="69"] Message portion. Test log with structured data.' | nc -w 1 -u localhost 514 Unfortunately it is showing up in logs as this: 2011-02-03T22:45:30+00:00 localhost 1 2011-02-03T22:14:15.003Z superhostomg process - ID47 [exampleSDID@32473 iut="9" eventSource="rawr" eventID="69"] Message portion. Test log with structured data. So all of the metadata is being printed to $MSG. What am I doing wrong? Thanks, ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html