Hey Allen,
I'd say that if you /are/ seeing '38' (or anything over 23) as a number
pre-pended, it's not the facility which was my first guess. Could be reporting
PID or other internal identifier of the sender, which some devices I see seem
to use. Just speculation.. Does the number change, if so how?
To verify that's actually being /sent/ by the syslog-ng forwarder, check the
output when logging to a local file as well as the remote forward using the
same src:template, and see if it shows up in both, as well look at the packets
as they hit the wire and see if it's in the payload. If it IS being sent by
your relay, also verify that it isn't actually in the payload sent by your log
client. Can you post the template/src/dest stanzas if you find it IS being
generated by the syslog-ng relay?
There's obvious likelihood that it's not syslog-ng on the sending host in
question, but at the receiving end or originating sender adding this.
/eli
Allen Bettilyon wrote:
> Hello,
>
> I'm doing some pretty basic syslog forwarding using syslog-ng 1.6.2.
>
> Essentially, I've got the following:
>
> destination remoteHost {
> tcp("1.1.1.1 <http://1.1.1.1> port 9999");
> };
>
>
> The forwarding is working correctly, however on the remote side all my
> log lines are prepended with a <number> tag.
>
> For example: Some log line
> turns into: <38>Some log line
>
> I've tried creating a custom template, but the <number> is always added
> to the log lines when the arrive at the remote host.
>
> Why is this happening and is there a way to turn it off?
>
> Thanks,
>
> - Allen Bettilyon
>
>
>
>
>
>