Hi! Paul Muther <dalamars@gmail.com> writes:
Just joined the list. I was wondering if there was a method to rewrite the severity of an event based on the text of the entry? I know I can use regex to read the message but from what I have seen I can't set the severity level of an event. In reading posts it would appear it was a feature under consideration in the past.
Sorry for the late reply, hope it's still relevant! According to the documentation[0], the FACILITY, SEVERITY, TAGS and the date related fields cannot be rewritten. However, there might be a workaround: catch the messages you want to rewrite, pipe them to a program that calls logger (with the appropriate facility & severity), and bingo. The only thing you need to pay attention is to avoid a loop: that's best done with using logger -u, and using a separate source for these rewritten logs. 0: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid... -- |8]