[syslog-ng] filter logger tags from syslog

[Jose Sanchez]

Hello,

I believe its working now, thanks a lot for everything.

--- On Thu, 11/26/09, Zoltán Pallagi <pzolee at balabit.hu> wrote:

> From: Zoltán Pallagi <pzolee at balabit.hu>
> Subject: Re: [syslog-ng] filter logger tags from syslog
> To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>, josesan311 at yahoo.com
> Date: Thursday, November 26, 2009, 1:48 PM
> 
> 
> 
>   
> 
>  
> Jose Sanchez írta:
> 
>   Hello Pallagi,
> 
> Thank you for the prompt response, very appreciated.
> Im running syslog at the client side and syslog-ng at the
> server side.
>   
> 
> Ok, I've tested it with this combination
> 
> 
>   Currently I have setup both and Im getting the
> following prefix into the log file on my syslog-ng server
> (this log is generated from apache on my client server),
> 
> "logger: XXX.XXX.XXX.XXX - - [26/Nov/2009:11:11:36
> -0600] \"GET... "
> 
> The issue is how can I configure syslog-ng to remove the
> "logger:" prefix when logging.
> Basically I just want a clean log same way like if I had an
> access_log file configured on apache on the client.
>   
> 
> I think my solution remove it.
> 
> original log in access.log:
> 
> 127.0.0.1 - - [26/Nov/2009:19:40:14 +0100] "GET /
> HTTP/1.1" 200 56 "-"
> "Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.15)
> Gecko/2009102815
> Ubuntu/9.04 (jaunty) Firefox/3.0.15"
> 
> 
> 
> log on the server without $MSG template:
> 
> Nov 26 20:02:25 127.0.0.1 logger[5645]: 127.0.0.1 - -
> [26/Nov/2009:20:02:25 +0100] "GET / HTTP/1.1" 200
> 56 "-" "Mozilla/5.0
> (X11; U; Linux i686; hu-HU; rv:1.9.0.15) Gecko/2009102815
> Ubuntu/9.04
> (jaunty) Firefox/3.0.15"
> 
> 
> 
> and the log on server with $MSG template (it was my
> solution):
> 
> 127.0.0.1 - - [26/Nov/2009:20:19:47 +0100] "GET /
> HTTP/1.1" 200 56 "-"
> "Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.15)
> Gecko/2009102815
> Ubuntu/9.04 (jaunty) Firefox/3.0.15"
> 
> 
> 
> There is no more "logger" prefix. Your config
> file also seems to be
> correct (but you have duplicated udp sources).
> 
> Didn't you forget to restart your syslog-ng? I
> don't really have more
> idea why it doesn't work for you.
> 
> 
> 
> 
>   
> Thank you in advance.
> 
> --- On Thu, 11/26/09, Pallagi Zoltán <pzolee at balabit.hu>
> wrote:
> 
>   
>   
>     From: Pallagi Zoltán <pzolee at balabit.hu>
> Subject: Re: [syslog-ng] filter logger tags from syslog
> To: "Syslog-ng users' and developers' mailing
> list" <syslog-ng at lists.balabit.hu>,
> josesan311 at yahoo.com
> Date: Thursday, November 26, 2009, 6:40 AM
> 
> 
> 
>   
>   
> 
>  
> Hi Jose,
> 
> 
> 
> Jose Sanchez írta:
> 
>   Hello,
> 
> I've been using classic syslog for centralizing apache
> access logs from one server to a remote syslog server, the
> thing is syslog adds some nasty tags before the lines in
> the
> access logs and I cant get them off, ie:
> 
> "Nov 25 21:25:37 server1 logger:"
> 
> I would like to know if syslog-ng has the option to filter
> this kind of stuff, I just want to have the logs sent to
> the
> syslog server exactly like I was saving them in a local
> access.log file.
>   
> 
> I don't understand you completely where you use
> syslog or syslog-ng on these hosts
> 
> 
> 
> If you use syslog-ng then yes the syslog-ng can do it.
> There is an
> example of the possible solutions if both sides are
> syslog-ng:
> 
> 
> 
> client side:
> 
> 
> 
> source s_file{file("/var/log/apache2/access.log"
> 
> flags(no-parse)
> 
> );};
> 
> 
> 
> destination d_tcp{tcp("10.30.0.32" port(666)
> 
> template("$MSG\n")
> 
> );};
> 
> 
> 
> log {
> 
> source(s_file);
> 
> destination(d_tcp);
> 
> };
> 
> 
> 
> 
> 
> server side:
> 
> source s_tcp{tcp(port(666)
> 
> flags(no-parse)
> 
> );};
> 
> 
> 
> destination d_test { file("/var/log/test.log"
> 
> template("$MSG\n")
> 
> ); };
> 
> 
> 
> log {
> 
> source (s_tcp);
> 
> destination(d_test);
> 
> };
> 
> 
> 
> 
> 
> if you use syslogd on client side and syslog-ng on the
> server side you
> need to use a config like this (but I am not sure in this
> case):
> 
> 
> 
> source s_tcp{udp(port(514));};
> 
> 
> 
> destination d_test { file("/var/log/test.log"
> 
> template("$MSG\n")
> 
> ); };
> 
> 
> 
> log {
> 
> source (s_tcp);
> 
> destination(d_test);
> 
> };
> 
> 
> 
> 
> 
> 
>   
> Thanks in advance.
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
>   
> 
> 
> 
>  
> 
> 
>     
>   
>  
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
>   
> 
> 
> 
>  
> 
>