[syslog-ng] parsing netapp syslog (2)
Balazs Scheidler
bazsi at balabit.hu
Thu May 21 09:12:20 CEST 2009
On Wed, 2009-05-20 at 09:10 +0200, David - DCPC wrote:
> Hello,
>
>
> I'm new on syslog-ng.
> I use v3.0.2 on a CentOS 4.4.
>
>
> I send syslog logs from a netapp FAS 2020 (*.*) to the syslog-ng
> server via udp.
>
>
> I have problem to analyse thoses logs. the lines have a different
> format than the standard syslog from another unix by example and are
> different than the BSD or IETF standard described in the syslog-ng
> documentation :
>
> (...)
> Tue May 19 11:27:30 CEST [netapp-L: wafl.quota.qtree.exceeded:notice]:
> tid 10: tree quota exceeded on volume linusers. Additional warnings
> will be suppressed for approximately 60 minutes or until a 'quota
> resize' is performed.
> (...)
hmm this includes an additional timezone & day information, neither of
which is supported by syslog-ng in this format.
These date formats are supported right now:
/* RFC3339 timestamp, expected format: YYYY-MM-DDTHH:MM:SS[.frac]<+/->ZZ:ZZ */
/* PIX timestamp, expected format: MMM DD YYYY HH:MM:SS: */
/* LinkSys timestamp, expected format: MMM DD HH:MM:SS YYYY */
/* RFC 3164 timestamp, expected format: MMM DD HH:MM:SS ... */
>
>
> 1°) When i use it in syslog-ng i get this line in a sample extraction
> without filter :
> (...)
> May 19 11:27:30 netapp-b wafl.quota.qtree.exceeded:notice]: tid 10:
> tree quota exceeded on volume linusers. Additional warnings will be
> suppressed for approximately 60 minutes or until a 'quota resize' is
> performed.
hmm.. I don't see how the timestamp was recognized, but I'm adding your
message to the testcases to see how....
I did, as it seems that syslog-ng assumes there's no date in the message
(since it is not recognized), then the first word is recognized as the
name of the program (e.g. $PROGRAM becomes Tue, since that's the first
word)
> (...)
> (difference between host named should come from the renaming of hosts
> during tests, and dns aliases, don't think this is the problem).
>
>
> Is it possible to correct the processus that parse the original line ?
> it seems that the parser block can be used only for the $MESSAGE part
> of the line.
you can use the 'no-parse' flag on your source, which means that the
complete incoming line is put in $MSG and the rest ($DATE and $HOST are
filled based on the reception information, e.g. the reception date and
the host that sent the message)
>
>
> 2°) It want to use other macro to make some filter and destination,
> like $PROGRAM. Is it possible to 'debug' the processing and have a
> details of macros and their contents, line by line ?
if you enable --debug option you can get debug output on filter
evaluation.
--
Bazsi
More information about the syslog-ng
mailing list