Aha! Thank you! On Tue, Jul 28, 2009 at 10:42 AM, Fegan, Joe<Joe.Fegan@hp.com> wrote:
Ah I see now. The full numeric syslog priority field you're looking for is called $PRI in syslog-ng. The other macro $PRIORITY is just an alias for $LEVEL i.e. only the bottom 3 bits of $PRI, translated into text.
-----Original Message----- From: Clayton Dukes [mailto:cdukes@gmail.com] Sent: 28 July 2009 15:27 To: Fegan, Joe Cc: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Questions about Facility, Priority and Level
On Tue, Jul 28, 2009 at 7:30 AM, Fegan, Joe<Joe.Fegan@hp.com> wrote:
The syslog wire protocol provides only one 8-bit integer field called "priority" to represent both facility and severity together. Severity is stored in the bottom three bits of the field (and therefore is an integer between 0 and 7) and facility is stored in the top 5 bits (and therefore is an integer between 0 and 31). Syslog-ng makes the priority value available to you as the macro $PRI and for your convenience it also derives the facility and severity values automatically and makes those available as $FACILITY and $LEVEL. So at all times PRI = (($FACILITY << 3) + $LEVEL) or looking at it the other way FACILITY = ($PRI >> 3) and LEVEL = ($PRI & 7)
Understood - and that's what I would have thought it was doing...but I'm still trying to figure out where/why it's inserting these levels as a string, not an int?
couldn't I just grab the PRI from the message and store only that in the table and use the code on my end to derive the FAC and SEV
Yes, absolutely.
Joe.
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: 28 July 2009 08:31 To: cdukes@cdukes.com; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Questions about Facility, Priority and Level
Hi,
I think you're confused a little bit. "informational" level is known by the windows agent of syslog-ng, not buy the unix syslog-ng daemon. If you're using the agent then you should ask BalaBit support it's non-free and I guess it is supported officially. I've never used the agent myself, sorry.
The priority should be stored as an integer. Where is your SQL schema originating from, and what is your sql destination definition?
Regards,
Sandor
On Mon, Jul 27, 2009 at 11:41 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Anyone that can comment on this?
On Wed, Jul 22, 2009 at 10:59 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Hey Guys,
According to the documentation: $LEVEL = Importance level of the message represented as a number: 6 - Success, 5 - Informational, 4- Warning, or 3 - Error). $FACILITY = The facility sending the message. $PRI = Priority header of the message, storing the facility and the level of the message.
Questions: What is the difference between LEVEL and PRI in syslog-ng? it doesn't seem to be storing anything but the level? When I look in the database, it shows identical information about the two:
mysql> select distinct priority from logs; +----------+ | priority | +----------+ | alert | | crit | | debug | | emerg | | err | | info | | notice | | warning | +----------+
mysql> select distinct level from logs; +---------+ | level | +---------+ | err | | info | | notice | | debug | | warning | | crit | | emerg | | alert | +---------+
According to the RFC: The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a syslog message, these values would be placed between the angle brackets as <0> and <165> respectively. The only time a value of "0" will follow the "<" is for the Priority value of "0". Otherwise, leading "0"s MUST NOT be used.
So, if that's the case, couldn't I just grab the PRI from the message and store only that in the table and use the code on my end to derive the FAC and SEV (I assume severity = level in syslog-ng)?
Also, is there a way to store these as integers from syslog-ng? There's a finite number of all of these, it seems that it would be better/faster to store them as an integer in the table and reference that in my code. Or I could use enum - not sure which is faster. Can I safely drop LEVEL or PRI and only keep one? it seems odd to have two columns for the same thing :-)
Thanks! ______________________________________________________________
Clayton Dukes ______________________________________________________________
-- ______________________________________________________________
Clayton Dukes ______________________________________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- ______________________________________________________________
Clayton Dukes ______________________________________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________