Unfortunately your question might seem simple, but really isn't. You are mentioning rfc5425 but in what way is this rfc5425? Is the client device sending it in that mode, due to a configuration setting? Can you show an example for this "rfc5425" message being incorrect? I would need to see how you configured syslog-ng to receive those messages, and the kind of device plus its settings. Unfortunately various devices mess up syslog in a lot of different ways, and although syslog-ng is able to cope with a lot of scenarios, it might not be all of them. So please describe: * The device sending the log, preferably with log related settings * The syslog-ng source declaration that you use to receive these messages * The syslog-ng destination declaration (and not just the template) that you use to send out the message * The end result in the consumer. Please try to explain what you see and what you'd expect at each state, as listed above. If you want,we could possibly get to our gitter channel where things can be discussed more interactively. Balázs On Mon, Nov 7, 2022, 13:23 Maurya, Shivani <shivani.maurya@intel.com> wrote:

Hi,

Please find the details below on the current template which we use for syslog-ng messages –

*FORMAT – *template("${R_ISODATE} ${FULLHOST_FROM} ${SOURCEIP} ${PRIORITY} ${FACILITY} ${PROGRAM} ${MSG}\n")

*EXAMPLE -* 2022-11-07T12:13:05+00:00 FQDN IP notice local7 6266821 Nov 7 12:15:58.043: *%ILPOWER-5-DETECT*: Interface Gi1/0/16: Power Device detected: Cisco PD

In the above example you can see the messages are prefixed with the %TAG. However with * rfc 5425*, the messages are not prefixed with %TAG & it’s a plain message.

Please let me know how to prefix the *rfc 5425 *messages with %TAG.

Regards,

Shivani Maurya

*From:* syslog-ng <syslog-ng-bounces@lists.balabit.hu> *On Behalf Of *Balazs Scheidler *Sent:* Monday, November 7, 2022 5:41 PM *To:* Syslog-ng users' and developers' mailing list < syslog-ng@lists.balabit.hu> *Subject:* Re: [syslog-ng] Syslog-ng Message Format

Yes, there's.

It would be great if you could show us how you send your output to the log consumer today, it would be easier to suggest solutions based on that.

On Mon, Nov 7, 2022, 12:09 Maurya, Shivani <shivani.maurya@intel.com> wrote:

Hi All,

With the older Syslog-ng RFC format (*rfc 3164*), the devices used to send the syslog messages in the below format –

%TAG TIMESTAMP FULLHOSTFROM SEVERITY MSG

*Example -* %SYSMGR-2-NON_VOLATILE_DB_INODE_FULL:2022 Nov 7 03:54:30 MST: SYSMGR-2-NON_VOLATILE_DB_INODE_FULL: System non-volatile inode storage usage is unexpectedly high at 96

But with the new syslog-ng RFC format (*rfc 5425*), the devices send the syslog messages in below format –

TIMESTAMP FULLHOSTFROM SEVERITY MSG

Is there a way to update/format the messages (rfc 5424) to be pre-fixed with %TAG ?

Regards,

Shivani Maurya

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq