[syslog-ng] Syslog-ng open source version -- program_override option

[Balazs Scheidler]

On Mon, 2009-08-10 at 11:41 +0530, Jain, Vaibhav (GE Healthcare) wrote:
> Hi,
>  
> I want to pass the source file name with each syslog-ng message. I am
> using program_override option for this. But program_override option
> overrides the program name field value present in the syslog-ng
> messages. 
>  
> source source_sys_log
> {
>     file("/root/log/syslog.log" program_override("syslog.log"));
> }
>  
> Let me know how to pass source file name in the syslog-ng message? I
> am using open source version of syslog-ng.
>  

Well by default syslog-ng uses each line in the source file as a
separate log message, but makes the name of the file available in the
$FILE_NAME macro.

So you could either use a custom template to include this information,
or rather a rewrite rule, such as:

rewrite r_add_filename { set("$FILE_NAME: $MESSAGE" value("MESSAGE")); };


-- 
Bazsi