Use receiving file name / path as a macro on the server
Hi all, I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?
Hi, On 03/03/2015 05:15 AM, Thanuje Ashwin Nallaperuma wrote:
Hi all,
I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?
I'm having some trouble understading what you're after. Do you want to simply transfer files from remote systems to a central place and keep a similar filesystem hierarchy on the central location as well? For such a purpose syslog isn't the preferred way as it isn't a generic purpose transport so use something else like rsync. There are ways to manipulate messages on the originating side (for example by adding tags to the syslog-ng source definitions) and encapsulating the extra information into the message payload you'll be able to extract the information on the remote side - but I'm not sure it worths the effort. hth, Sandor
Hi Sandor, I do not need to maintain the file hierarchy I just one to transfer the file path to the server and use it as a macro on the server side because the path is the only way I am able to identify the files I send as they have the same name and same content On Tue, Mar 3, 2015 at 1:35 PM, Sandor Geller <sandor.geller@ericsson.com> wrote:
Hi,
On 03/03/2015 05:15 AM, Thanuje Ashwin Nallaperuma wrote:
Hi all,
I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?
I'm having some trouble understading what you're after. Do you want to simply transfer files from remote systems to a central place and keep a similar filesystem hierarchy on the central location as well? For such a purpose syslog isn't the preferred way as it isn't a generic purpose transport so use something else like rsync.
There are ways to manipulate messages on the originating side (for example by adding tags to the syslog-ng source definitions) and encapsulating the extra information into the message payload you'll be able to extract the information on the remote side - but I'm not sure it worths the effort.
hth,
Sandor
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi, If I understand you well, You should use HOST macro in the file name. BR, Viktor Juhasz On Tue, Mar 3, 2015 at 10:57 AM, Thanuje Ashwin Nallaperuma < thanuje88@gmail.com> wrote:
Hi Sandor,
I do not need to maintain the file hierarchy I just one to transfer the file path to the server and use it as a macro on the server side because the path is the only way I am able to identify the files I send as they have the same name and same content
On Tue, Mar 3, 2015 at 1:35 PM, Sandor Geller <sandor.geller@ericsson.com> wrote:
Hi,
On 03/03/2015 05:15 AM, Thanuje Ashwin Nallaperuma wrote:
Hi all,
I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?
I'm having some trouble understading what you're after. Do you want to simply transfer files from remote systems to a central place and keep a similar filesystem hierarchy on the central location as well? For such a purpose syslog isn't the preferred way as it isn't a generic purpose transport so use something else like rsync.
There are ways to manipulate messages on the originating side (for example by adding tags to the syslog-ng source definitions) and encapsulating the extra information into the message payload you'll be able to extract the information on the remote side - but I'm not sure it worths the effort.
hth,
Sandor
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi Vikrot, $HOST gives the IP address or the FQDN according to the settings I am looking for a way to pass the log file path as a string to the syslog-master and use it On Tue, Mar 3, 2015 at 3:46 PM, Juhász, Viktor <viktor.juhasz@balabit.com> wrote:
Hi,
If I understand you well, You should use HOST macro in the file name.
BR, Viktor Juhasz
On Tue, Mar 3, 2015 at 10:57 AM, Thanuje Ashwin Nallaperuma < thanuje88@gmail.com> wrote:
Hi Sandor,
I do not need to maintain the file hierarchy I just one to transfer the file path to the server and use it as a macro on the server side because the path is the only way I am able to identify the files I send as they have the same name and same content
On Tue, Mar 3, 2015 at 1:35 PM, Sandor Geller <sandor.geller@ericsson.com
wrote:
Hi,
On 03/03/2015 05:15 AM, Thanuje Ashwin Nallaperuma wrote:
Hi all,
I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?
I'm having some trouble understading what you're after. Do you want to simply transfer files from remote systems to a central place and keep a similar filesystem hierarchy on the central location as well? For such a purpose syslog isn't the preferred way as it isn't a generic purpose transport so use something else like rsync.
There are ways to manipulate messages on the originating side (for example by adding tags to the syslog-ng source definitions) and encapsulating the extra information into the message payload you'll be able to extract the information on the remote side - but I'm not sure it worths the effort.
hth,
Sandor
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
"Thanuje" == Thanuje Ashwin Nallaperuma <thanuje88@gmail.com> writes:
Thanuje> I have multiple files with the same content on the syslog-ng client Thanuje> These files are stored on different locations with the same file name and Thanuje> same content Thanuje> After receiving I want to store these files with different names on Thanuje> sysog-ng server Thanuje> Is there any way I could use the filepath or filename of the receiving file Thanuje> as a macro Thanuje> or any way to achieve this..? When sending the message, the $FILE_NAME macro contains the path of the file. You can add it to the template on the sending end, and extract it on the receiving end, and use that as you will. The easiest way to accomplish this is either $(format-json) (and json-parser() on the other end), or using RFC 5424 syslog(), and setting SDATA.filename (or somesuch) to $FILE_NAME in a rewrite rule. That way, it will be automatically available on the receiving end, and you can transform them in whatever way you prefer. -- |8]
Hi Gergely, This worked. :) Thank you very much On Tue, Mar 3, 2015 at 6:11 PM, Gergely Nagy <algernon@madhouse-project.org> wrote:
"Thanuje" == Thanuje Ashwin Nallaperuma <thanuje88@gmail.com> writes:
Thanuje> I have multiple files with the same content on the syslog-ng client Thanuje> These files are stored on different locations with the same file name and Thanuje> same content Thanuje> After receiving I want to store these files with different names on Thanuje> sysog-ng server Thanuje> Is there any way I could use the filepath or filename of the receiving file Thanuje> as a macro Thanuje> or any way to achieve this..?
When sending the message, the $FILE_NAME macro contains the path of the file. You can add it to the template on the sending end, and extract it on the receiving end, and use that as you will.
The easiest way to accomplish this is either $(format-json) (and json-parser() on the other end), or using RFC 5424 syslog(), and setting SDATA.filename (or somesuch) to $FILE_NAME in a rewrite rule. That way, it will be automatically available on the receiving end, and you can transform them in whatever way you prefer.
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (4)
-
Gergely Nagy
-
Juhász, Viktor
-
Sandor Geller
-
Thanuje Ashwin Nallaperuma