Thanks for the information. I have another issue that has come up relating to the PROGRAM macro.
When I configure it
like this, the PROGRAM macro works properly and gets the proper tag from the
client:
source s_syslog-ports {
# Configure
the network() driver for receiving RFC3164 logs
network(transport("udp") ip(10.25.10.52) port(514));
network(transport("tcp") ip(10.25.10.52) port(514)
max-connections(100));
network(transport("tcp") ip(10.25.10.52) port(1514)
max-connections(100));
};
filter f_Linux-centos {
in-list("/etc/syslog-ng/filter/Linux-centos.txt",
value("SOURCEIP")); };
destination d_Linux-centos
{file("/var/log/IT/server/Linux/CentOS/${SOURCEIP}/${SOURCEIP}[${PROGRAM}]-${YEAR}${MONTH}${DAY}.log"
template(t_message-only));};
log {source(s_syslog-ports); filter(f_Linux-centos);
destination(d_Linux-centos);};
Then, when I change
the configuration to this, the PROGRAM macro no longer gets the same proper tag
value from the client:
source s_syslog-ports {
# Configure
the network() driver for receiving RFC3164 logs
network(transport("udp") ip(10.25.10.52) port(514));
network(transport("tcp") ip(10.25.10.52) port(514)
max-connections(100));
network(transport("tcp") ip(10.25.10.52) port(1514)
max-connections(100) flags(no-parse));
};
filter f_Linux-centos {
in-list("/etc/syslog-ng/filter/Linux-centos.txt",
value("SOURCEIP")); };
destination d_Linux-centos
{file("/var/log/IT/server/Linux/CentOS/${SOURCEIP}/${SOURCEIP}[${PROGRAM}]-${YEAR}${MONTH}${DAY}.log"
template(t_message-only));};
log {source(s_syslog-ports); junction { channel { filter(f_Linux-centos); parser { syslog-parser(); }; flags(final); }; };
destination(d_Linux-centos);};
Is there a way to configure the no-parse and junction option while still getting the correct PROGRAM macro data?
Thanks.
On Wednesday, February 22, 2017 8:04 AM, "Fekete, Róbert" <robert.fekete@balabit.com> wrote:
Hi,
To achieve something like that, you have to use junctions.
You'll have one source with flags(no-parse), then embed a filter+parser junction to process regular syslog messages, and another junction to process the ones you cannot parse.
HTH,
Robert