[syslog-ng] Losing TAG information

[SOLIS, ALEX]

I appreciate your sympathy but it does not help me with my TAG problem.
:)

Anyone else have any idea how to stop syslog-ng from purging the TAG
information from an AIX syslogd message.  I have successfully sniffed
syslog traffic between the AIX servers and my LOGHOST.  The TAG (Process
Name info) is definitely intact on the wire.  This confirms that
syslog-ng is simply parsing the log message and removing the TAG info.

I did some more tests on the Linux LOGHOST using the logger utility and
I found that syslog-ng does not like spaces after the TAG information.
For example:

1)	   Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE"
	
	Generates the log:

	   Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE

	
2)	   Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE"

	Generates the log:

	    Jun 19 08:44:08 loghost : TEST_MESSAGE

Example two lost the TAG information because of the space after
TEST_TAG.  I have considered the possibility that the messages being
sent from the AIX box do not conform to syslog formatting standards and
therefore syslog-ng discards the field.  But I would like to know if
there is anything that can be done to stop this behavior. 

Thanks for all responses, even sympathetic ones. :)

Alex
	

-----Original Message-----
From: Valdis.Kletnieks at vt.edu [mailto:Valdis.Kletnieks at vt.edu] 
Sent: Tuesday, June 13, 2006 9:09 PM
To: SOLIS, ALEX
Subject: Re: [syslog-ng] Losing TAG information

On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said:

 (off-list reply)

> I have about 20 or so AIX 4.3 servers that are sending syslog messages
> to a Linux desktop running syslog-ng 1.6.5. 

You have my condolences.  IBM dropped support for even AIX 4.3.3 several
years ago - hopefully you're not having problems keeping the software
running and secure...
-----Original Message-----
From: Valdis.Kletnieks at vt.edu [mailto:Valdis.Kletnieks at vt.edu] 
Sent: Tuesday, June 13, 2006 9:09 PM
To: SOLIS, ALEX
Subject: Re: [syslog-ng] Losing TAG information

On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said:

 (off-list reply)

> I have about 20 or so AIX 4.3 servers that are sending syslog messages
> to a Linux desktop running syslog-ng 1.6.5. 

You have my condolences.  IBM dropped support for even AIX 4.3.3 several
years ago - hopefully you're not having problems keeping the software
running and secure...

This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient.  Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance.  If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.