file source driver questions
Hi, I have an application here that does not use syslog but writes all log messages straight into a file. I want to use syslog-ng to pick up the entries of that file and send them over to my log repository via syslog. I am running 3.0.1 and the config looks as follows: * Client side (radserver): source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse)); }; destination d_archive { udp ("a.b.c.d"); }; log { source (s_accounting); destination (d_archive); }; * Server side (a.b.c.d): source s_udp { udp (); }; destination d_radius { file ("/usr/local/var/log/remote/$HOST_FROM/ accounting.log" template ("$MSGONLY\n")); }; filter f_radius { host ("radserver") and facility (kern); }; log { source (s_udp); filter (f_radius); destination (d_radius); flags (final); }; That works but there are a couple of minor things. - By default all messages coming from the file source driver are tagged with the kern facility. I was not able to find this in the documentation but the source code (cfg-grammar.y) revealed that the file driver accepts the options "facility()" and "level()" to change this behavior. source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse) facility (local7)); }; fixed that problem. - Empty lines seem to be ignored and not transmitted. The entries: "La la blah blah Hi There good-bye" end up as "La la blah blah Hi There good-bye" in my log file on the server side. Is there a way to enable that? Thanks! - Michael
On Thu, 2009-02-12 at 11:53 -0500, Michael Hocke wrote:
- By default all messages coming from the file source driver are tagged with the kern facility. I was not able to find this in the documentation but the source code (cfg-grammar.y) revealed that the file driver accepts the options "facility()" and "level()" to change this behavior.
source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse) facility (local7)); };
True enough, it should be added there.
- Empty lines seem to be ignored and not transmitted. The entries:
"La la blah blah
Hi There good-bye"
end up as
"La la blah blah Hi There good-bye"
in my log file on the server side. Is there a way to enable that?
this is intentional right now, empty lines are ignored. it is not very difficult to add support for this, so I've just implemented it: commit 41f77f536a4e442d8dd2e0b6276987c07ac09b45 Author: Balazs Scheidler <bazsi@balabit.hu> Date: Sun Feb 15 09:46:35 2009 +0100 [logreader] implement 'empty-lines' flag This new flag allows the transmission of zero-length messages. You can find it in the git repository, or tomorrow's daily snapshot. You can use it by specifying flags(empty-lines) to the source reading your log file. -- Bazsi
On Feb 15, 2009, at 3:47 AM, Balazs Scheidler wrote:
this is intentional right now, empty lines are ignored. it is not very difficult to add support for this, so I've just implemented it:
Thanks for the quick response and fix. It works like a charm. - Michael
participants (2)
-
Balazs Scheidler
-
Michael Hocke