[syslog-ng] filter logger tags from syslog

[Zoltán Pallagi]

Jose Sanchez írta:
> Hello Pallagi,
>
> Thank you for the prompt response, very appreciated.
> Im running syslog at the client side and syslog-ng at the server side.
>   
Ok, I've tested it with this combination
> Currently I have setup both and Im getting the following prefix into the log file on my syslog-ng server (this log is generated from apache on my client server),
>
> "logger: XXX.XXX.XXX.XXX - - [26/Nov/2009:11:11:36 -0600] \"GET... "
>
> The issue is how can I configure syslog-ng to remove the "logger:" prefix when logging.
> Basically I just want a clean log same way like if I had an access_log file configured on apache on the client.
>   
I think my solution remove it.
original log in access.log:
127.0.0.1 - - [26/Nov/2009:19:40:14 +0100] "GET / HTTP/1.1" 200 56 "-" 
"Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.15) Gecko/2009102815 
Ubuntu/9.04 (jaunty) Firefox/3.0.15"

log on the server without $MSG template:
Nov 26 20:02:25 127.0.0.1 logger[5645]: 127.0.0.1 - - 
[26/Nov/2009:20:02:25 +0100] "GET / HTTP/1.1" 200 56 "-" "Mozilla/5.0 
(X11; U; Linux i686; hu-HU; rv:1.9.0.15) Gecko/2009102815 Ubuntu/9.04 
(jaunty) Firefox/3.0.15"

and the log on server with $MSG template (it was my solution):
127.0.0.1 - - [26/Nov/2009:20:19:47 +0100] "GET / HTTP/1.1" 200 56 "-" 
"Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.15) Gecko/2009102815 
Ubuntu/9.04 (jaunty) Firefox/3.0.15"

There is no more "logger" prefix. Your config file also seems to be 
correct (but you have duplicated udp sources).
Didn't you forget to restart your syslog-ng? I don't really have more 
idea why it doesn't work for you.

> Thank you in advance.
>
> --- On Thu, 11/26/09, Pallagi Zoltán <pzolee at balabit.hu> wrote:
>
>   
>> From: Pallagi Zoltán <pzolee at balabit.hu>
>> Subject: Re: [syslog-ng] filter logger tags from syslog
>> To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>, josesan311 at yahoo.com
>> Date: Thursday, November 26, 2009, 6:40 AM
>>
>>
>>
>>   
>>   
>>
>>  
>> Hi Jose,
>>
>>
>>
>> Jose Sanchez írta:
>>
>>   Hello,
>>
>> I've been using classic syslog for centralizing apache
>> access logs from one server to a remote syslog server, the
>> thing is syslog adds some nasty tags before the lines in the
>> access logs and I cant get them off, ie:
>>
>> "Nov 25 21:25:37 server1 logger:"
>>
>> I would like to know if syslog-ng has the option to filter
>> this kind of stuff, I just want to have the logs sent to the
>> syslog server exactly like I was saving them in a local
>> access.log file.
>>   
>>
>> I don't understand you completely where you use
>> syslog or syslog-ng on these hosts
>>
>>
>>
>> If you use syslog-ng then yes the syslog-ng can do it.
>> There is an
>> example of the possible solutions if both sides are
>> syslog-ng:
>>
>>
>>
>> client side:
>>
>>
>>
>> source s_file{file("/var/log/apache2/access.log"
>>
>> flags(no-parse)
>>
>> );};
>>
>>
>>
>> destination d_tcp{tcp("10.30.0.32" port(666)
>>
>> template("$MSG\n")
>>
>> );};
>>
>>
>>
>> log {
>>
>> source(s_file);
>>
>> destination(d_tcp);
>>
>> };
>>
>>
>>
>>
>>
>> server side:
>>
>> source s_tcp{tcp(port(666)
>>
>> flags(no-parse)
>>
>> );};
>>
>>
>>
>> destination d_test { file("/var/log/test.log"
>>
>> template("$MSG\n")
>>
>> ); };
>>
>>
>>
>> log {
>>
>> source (s_tcp);
>>
>> destination(d_test);
>>
>> };
>>
>>
>>
>>
>>
>> if you use syslogd on client side and syslog-ng on the
>> server side you
>> need to use a config like this (but I am not sure in this
>> case):
>>
>>
>>
>> source s_tcp{udp(port(514));};
>>
>>
>>
>> destination d_test { file("/var/log/test.log"
>>
>> template("$MSG\n")
>>
>> ); };
>>
>>
>>
>> log {
>>
>> source (s_tcp);
>>
>> destination(d_test);
>>
>> };
>>
>>
>>
>>
>>
>>
>>   
>> Thanks in advance.
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.campin.net/syslog-ng/faq.html
>>
>>
>>   
>>
>>
>>
>>  
>>
>>
>>     
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20091126/4a848454/attachment-0001.htm