$EVENT_SOURCE and $USERNAME are blank
Hi all! When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file. here is an excerpt of my configuration file.. destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MONTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); }; anybody knows why this occurs? Cheers, Gustavo
Hello,
Hi all!
When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file.
here is an excerpt of my configuration file..
destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MO NTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); };
anybody knows why this occurs?
Where did you find USERNAME and EVENT_SOURCE referred? syslog-ng 2.0 doesn't set these. You can find every macros in src/macros.c Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
Hello,
Hi all!
When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file.
here is an excerpt of my configuration file..
destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MO NTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); };
anybody knows why this occurs?
Where did you find USERNAME and EVENT_SOURCE referred? syslog-ng 2.0 doesn't set these. You can find every macros in src/macros.c
I've just checked the latest syslog-ng admin guide, so I'm correcting myself: these are used only by the windows agent, the unix version (at least the open source one) doesn't have support for these variables. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
participants (2)
-
Geller, Sandor (IT)
-
Gustavo Soares