[syslog-ng] [Bug 88] rewrite FACILITY does not work.

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=88


Balazs Scheidler <bazsi at balabit.hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|                            |FIXED
             Status|NEW                         |RESOLVED




--- Comment #1 from Balazs Scheidler <bazsi at balabit.hu>  2010-06-23 20:42:24 ---
that's right, FACILITY is not a name-value pair and the rewrite framework doesn't handle that.

version 3.1 even displays a warning in this case:

                msg_warning("Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead",
                            evt_tag_str("macro", p),
                            NULL);

The problem with changing FACILITY is that it is not a string-like value of the log message.

Also, there's no such thing as "apache" facility, facilities are defined in the RFC and only the given set can be used 
(syslog-ng also supports 'numeric' facility codes, but that's not very interoperable).

I'm not sure what you exactly want to achieve, but if all you need is to associate the application name to a message, then either use tags, or use a different
name value pair (e.g. APPLICATION)

And last but not least, I'm planning to implement rewrite support for facility/severity fields, but not in 3.0


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.