[syslog-ng] filter logger tags from syslog

[Jose Sanchez]

Hello Pallagi,

Thank you for the prompt response, very appreciated.
Im running syslog at the client side and syslog-ng at the server side.
Currently I have setup both and Im getting the following prefix into the log file on my syslog-ng server (this log is generated from apache on my client server),

"logger: XXX.XXX.XXX.XXX - - [26/Nov/2009:11:11:36 -0600] \"GET... "

The issue is how can I configure syslog-ng to remove the "logger:" prefix when logging.
Basically I just want a clean log same way like if I had an access_log file configured on apache on the client.

Thank you in advance.

--- On Thu, 11/26/09, Pallagi Zoltán <pzolee at balabit.hu> wrote:

> From: Pallagi Zoltán <pzolee at balabit.hu>
> Subject: Re: [syslog-ng] filter logger tags from syslog
> To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>, josesan311 at yahoo.com
> Date: Thursday, November 26, 2009, 6:40 AM
> 
> 
> 
>   
>   
> 
>  
> Hi Jose,
> 
> 
> 
> Jose Sanchez írta:
> 
>   Hello,
> 
> I've been using classic syslog for centralizing apache
> access logs from one server to a remote syslog server, the
> thing is syslog adds some nasty tags before the lines in the
> access logs and I cant get them off, ie:
> 
> "Nov 25 21:25:37 server1 logger:"
> 
> I would like to know if syslog-ng has the option to filter
> this kind of stuff, I just want to have the logs sent to the
> syslog server exactly like I was saving them in a local
> access.log file.
>   
> 
> I don't understand you completely where you use
> syslog or syslog-ng on these hosts
> 
> 
> 
> If you use syslog-ng then yes the syslog-ng can do it.
> There is an
> example of the possible solutions if both sides are
> syslog-ng:
> 
> 
> 
> client side:
> 
> 
> 
> source s_file{file("/var/log/apache2/access.log"
> 
> flags(no-parse)
> 
> );};
> 
> 
> 
> destination d_tcp{tcp("10.30.0.32" port(666)
> 
> template("$MSG\n")
> 
> );};
> 
> 
> 
> log {
> 
> source(s_file);
> 
> destination(d_tcp);
> 
> };
> 
> 
> 
> 
> 
> server side:
> 
> source s_tcp{tcp(port(666)
> 
> flags(no-parse)
> 
> );};
> 
> 
> 
> destination d_test { file("/var/log/test.log"
> 
> template("$MSG\n")
> 
> ); };
> 
> 
> 
> log {
> 
> source (s_tcp);
> 
> destination(d_test);
> 
> };
> 
> 
> 
> 
> 
> if you use syslogd on client side and syslog-ng on the
> server side you
> need to use a config like this (but I am not sure in this
> case):
> 
> 
> 
> source s_tcp{udp(port(514));};
> 
> 
> 
> destination d_test { file("/var/log/test.log"
> 
> template("$MSG\n")
> 
> ); };
> 
> 
> 
> log {
> 
> source (s_tcp);
> 
> destination(d_test);
> 
> };
> 
> 
> 
> 
> 
> 
>   
> Thanks in advance.
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
>   
> 
> 
> 
>  
> 
>