[syslog-ng] $EVENT_SOURCE and $USERNAME are blank

Geller, Sandor (IT) Sandor.Geller at morganstanley.com
Wed Aug 1 09:47:36 CEST 2007


> Hello,
> 
> > Hi all!
> > 
> > When I try to capture the EVENT_SOURCE or USERNAME variables 
> > within the template clause, these fields are logged blank in 
> > the log file.
> > 
> > here is an excerpt of my configuration file..
> > 
> > destination local6 { 
> > file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MO
> NTH$YEAR.log" 
> >                      template("$DATE User:$USERNAME 
> > $EVENT_SOURCE $MESSAGE\n") template_escape(yes)
> >                      owner(watcher) group(other) 
> create_dirs(yes)); };
> > 
> > 
> > anybody knows why this occurs? 
> 
> Where did you find USERNAME and EVENT_SOURCE referred? syslog-ng 2.0
> doesn't set these. You can find every macros in src/macros.c

I've just checked the latest syslog-ng admin guide, so I'm correcting
myself: these are used only by the windows agent, the unix version
(at least the open source one) doesn't have support for these variables.

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.


More information about the syslog-ng mailing list