On Mon, 2011-08-08 at 17:04 +0200, Javi Polo wrote:
El 08/06/2011 06:56 PM, Balazs Scheidler escribió:
As you can see, the program_name has dissapeared I suspect is a bug, but I'm not sure as there might be some change in syslog-ng behaviour that I did miss :? flags(dont-store-legacy-msghdr)
I wanted to explain why, but I'm in a hurry, probably in an upcoming post. (the flag might be called no-store-..., can't remember exactly)
Thanks! I found an explanation there http://bazsi.blogs.balabit.com/2010/05/small-incompatible-change-for-3-1/
However, it still doesnt work As the flag 'dont-store-legacy-msghdr' is set on the 'source' statement in the logserver host, it seems it doesnt affect the syslog-ng generating the log, which stripes the program from the log-line
I tried to put 'dont-store-legacy-msghdr' flag in the originating host, under 'destination' statement, but syslog-ng complains that the flag is invalid there ...
I have switched back to syslog-ng 3.0 till I can resolve this issue
you need the flag on the host that has program-override(), program-override() will not work if store-legacy-msghdr is enabled, unless the destination template is customized too. If the client syslog-ng has program-override(), then you need the flag on that host, on its source statement. -- Bazsi