Re: [syslog-ng] [Fw: keep_hostname (yes); and source file]

On Fri, 2011-05-27 at 18:44 -0400, Steven Blatchford wrote:

There seems to be no hostname associated with file() so it uses the first word of the message. The first word of the log message is 'DEBUG'. On the central log server I added 'DEBUG' to the filter host and it worked.

Is there a way to set the hostname when the source uses file() ?

That happens because syslog-ng tries to parse the file as if it was in syslog format. You can disable parsing with flags(no-parse). With that the content of each line will become part of $MSG and syslog-ng will prepend a syslog header when sending it to the server. -- Bazsi