[syslog-ng] syslog-ng Digest, Vol 28, Issue 21

[Nate Campi]

On Fri, Sep 07, 2007 at 05:26:02PM +0800, Wilson Lai wrote:
> Dear all,
>        What happen if the log message is not a standard syslog message?
>        Thanks.

If a Cisco switch sends a message like this:
2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16

...it'll be written to disk like this:

Aug 23 03:04:05 switch.company.com 2005 Aug 23 03:04:05 UTC +00:00 %PAGP-5-PORTFROMSTP:Port 4/16 left bridge port 4/16

syslog servers put in a proper syslog formatted header.

The behavior is documented here:

 http://www.faqs.org/rfcs/rfc3164.html

It's not syslog-ng specific behavior.
-- 
Nate

"The IBM compatible sector has not yet recognized that 95% of computer
usage is devoted to experimenting with different fonts and character
styles in documents." - Reiner, Ron