[syslog-ng] ArcSight Server As Destination?

[Evan Rempel]

Balazs Scheidler wrote:
> Syslog-ng forwards messages in the same
> format as it receives it, it does not prepend headers, only replaces
> values if it is configured to do so.

Really? My experience is one where syslong-ng receives a syslog message that does NOT
contain a timestamp, and syslog-ng forwards it with a timestamp because the receiver
portion of syslog-ng has added a timestamp.

Am I remembering this incorrectly or confusing this with some custom template?

-- 
Evan Rempel                erempel at uvic.ca
Senior Programmer Analyst        250.721.7691
Computing Services
University of Victoria