[syslog-ng] TAG-Macro

Balazs Scheidler bazsi at balabit.hu
Tue Mar 18 12:46:12 CET 2008


On Mon, 2008-03-17 at 14:13 +0100, JUNG, Christian wrote:
> Hello,
> 
> we've been using the old BSD-implementation of syslogd on linux for quite a while and want to migrate to Syslog NG now.
> 
> We've got the problem, that the priority/facility-encoding of the $TAG macro isn't the same as running syslogd with option -S. Here an excerpt of syslogd's man-page:
> 
> ---8<---
> The priority/facility code takes the form of a priority number followed by a letter that indicates the facility. The priority number can range from 0 to 7. The facility letter can range from 'A' to 'Y', where 'A' corresponds to facility number zero (LOG_KERN), 'B' corresponds to facility 1 (LOG_USER), etc. See /usr/include/sys/syslog.h for a list of priority and LOG_xxx codes.
> 
> Example:
> 
>     Jun 27 19:22:20 5Q:silence test[1966]: testing 
> 
> The above message contains a priority/facility code of '5Q', which breaks down to a priority of 5 (LOG_NOTICE) and a facility of 16 (LOG_LOCAL0).
> ---8<---
> 
> I'd like to add this functionality to syslog-ng because this encoding is more suitable for log-analysis etc. as the hexadecimal format. Should I use a different macro-name (if yes: which?) or should I modify the TAG part in macro.c?

Definitely a different macro, there are other who use the old syntax
already.

Something like BSDTAG?

-- 
Bazsi



More information about the syslog-ng mailing list