Hello List, I'm using the syslog-ng OSE version 3.1.2. Currently, I have a syslog-ng server which collects events from several devices : routers (Cisco), switches (Alcatel), other devices which send events to the syslog server by using the port 514 with the protocol UDP. For the router and the switch, I need to use the flag "no-parse" because I have to parse the content of the message by using "patterndb.xml". But... for the others devices I don't want to use the flag "no-parse" because the events respect the syslog format. I think it's not possible to configure syslog-ng like this : source s_udp_01 { udp (flags(no-parse); }; source s_udp_02 { udp (); }; log { source (s_udp_01); (...) }; log { source (s_udp_02); (...) }; The workaround could be the modification of udp port destination for the devices but it's not possible for the switch Alcatel. For the router Cisco, I don't know if it's possible or not... Someone would have an idea for that "problem" ? Regards, Yann I.
Someone would have an idea for that "problem" ?
Perhaps there's a better way, but... You could give your log server multiple ip addresses, and then bind your sources explicitly: source s_1 { udp( ip(192.168.1.20) flags(no_parse) ); } source s_2 { udp( ip(192.168.1.21) ); }; Then configure a different syslog server address into each device depending on whether you want to run the logs through the parser or not.
On Wednesday, November 10, 2010 05:57:34 Yann I. wrote:
For the route Cisco, I don't know if it's possible or not...
It's possible to change the destination port on Cisco. Check out the documentation: logging host 209.165.201.1 transport udp port 601 http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html -- Matthew Hall
Perhaps there's a better way, but...
You could give your log server multiple ip addresses, and then bind your sources explicitly:
source s_1 { udp( ip(192.168.1.20) flags(no_parse) ); }
source s_2 { udp( ip(192.168.1.21) ); };
Then configure a different syslog server address into each device depending on whether you want to run the logs through the parser or not.
Good idea but I can't add another IP address... http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
Thank you for the documentation !
Regards, Yann I. 2010/11/10 Matthew Hall <mhall@mhcomputing.net>
On Wednesday, November 10, 2010 05:57:34 Yann I. wrote:
For the route Cisco, I don't know if it's possible or not...
It's possible to change the destination port on Cisco.
Check out the documentation:
logging host 209.165.201.1 transport udp port 601
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
-- Matthew Hall
On Wed, Nov 10, 2010 at 05:45:12PM +0100, Yann I. wrote:
Good idea but I can't add another IP address...
If you go the IP alias route, simply Remove the existing IP and add the new IP.
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
Regards, Yann I.
Matthew.
participants (3)
-
Lars Kellogg-Stedman
-
Matthew Hall
-
Yann I.