[syslog-ng]use_time_recvd(no) not working?

[Nicholas Berry]

I have emailed a problem I've had a couple times, but I was playing around with the template() feature and found a little more preciously what the problem may be.

With template() defined as template("$DATE $HOST $MSG\n"), this is the output I receive:
 Mar  8 16:32:29 smf-jumpstart   A á     A á<149>Mar  8 16:32:29 sudo: [ID 850335
  local2.notice]   nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COM
  MAND=/usr/ucb/whoami

With template() defined as template("$MSG\n"), this is the output I receive:
 <149>Mar  8 16:40:15 sudo: [ID 850335 local2.notice]   nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; 
  COMMAND=/usr/ucb/whoami

The examples were from a Solaris 8 host using its default syslog daemon, but I have similar issues on *all* other syslog reporting devices (routers, modem banks, etc.)

One thing that seems to be consistent between all syslog reporting devices is <X>.  Is this some sort of reference that syslogd uses?  Can I filter this out? Or will it cause a problem?  Also, in the first example "   A á     A á" is another commonality between hosts.  What is the default template() used?

I've seen reference to use of "$DATE_RECVD" as an acceptable macro, but I don't see this listed in the documentation.  Is there a document set with these new available macros?

Nicholas Berry 
Systems Engineer 
RagingWire Telecommunications, Inc. 
2710 Gateway Oaks Dr., Suite 300 South 
Sacramento, CA 95833 
Phone: 916.286.4048 
Fax: 916.921.4148 
E-mail: nberry@ragingwire.com 
www.ragingwire.com 


-----Original Message-----
From: Balazs Scheidler [mailto:bazsi@balabit.hu] 
Sent: Friday, March 08, 2002 12:37 AM
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng]use_time_recvd(no) not working?


> a) do you have any tips on tracking down the problem with the broken
> pam-timestamps?
> b) is the use_time_recvd() option broken/non-existant in 1.5.14 ?

it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this:

destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); };

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng