[syslog-ng] [Bug 152] New: Vers 3.3.3 pipe source does not parse host from input line

bugzilla at bugzilla.balabit.com bugzilla at bugzilla.balabit.com
Tue Dec 6 22:50:19 CET 2011


https://bugzilla.balabit.com/show_bug.cgi?id=152

           Summary: Vers 3.3.3 pipe source does not parse host from input
                    line
           Product: syslog-ng
           Version: 3.3.x
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: erempel at uvic.ca
Type of the Report: ---
   Estimated Hours: 0.0


Try as I might, I can not get a pipe source to maintain the hostname. Syslog-ng includes the hostname
as the $MSGHDR (or the $PROGRAM).

my config
# -----------------------------------
source patterndb { pipe("/var/log/syslog.pipes/patterndb" log_fetch_limit(500) log_iw_size(100000) ); };
source int { internal(); };

template t_standardfile { template("$S_ISODATE $FULLHOST $FACILITY.$LEVEL $MSGHDR][$PROGRAM][$MESSAGE\n"); template_escape(no); };

destination d_var_patterndb { file("/var/log/patterndb.$R_YEAR$R_MONTH$R_DAY.000000" owner("root") group("syslogs") perm(0640) template(t_standardfile)); };

log { source(patterndb); destination(d_var_patterndb); };
# -----------------------------------

data I write tothe pipe

# -----------------------------------
<12>2011-11-25T00:00:30-08:00 somehost.uvic.ca mmfs: Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350>
<12>2011-11-25T00:00:30-08:00 somehost.uvic.ca mmfs: Fri Nov 25 00:00:29.620 2011: Connecting to 172.20.107.23 nestor0167 <c0n200>
<12>2011-11-25T00:00:30-08:00 somehost.uvic.ca mmfs: Fri Nov 25 00:00:29.621 2011: Connected to 172.20.107.23 nestor0167 <c0n200>
# -----------------------------------

The output file
# -----------------------------------
2011-11-25T00:00:30-08:00 patterndb at catamount.comp.uvic.ca user.warning somehost.uvic.ca ][somehost.uvic.ca][mmfs: Fri Nov 25 00:00:29.618 2011: Accepted and
connected to 172.20.102.38 hermes0080 <c0n350>
2011-11-25T00:00:30-08:00 patterndb at catamount.comp.uvic.ca user.warning somehost.uvic.ca ][somehost.uvic.ca][mmfs: Fri Nov 25 00:00:29.620 2011: Connecting to
172.20.107.23 nestor0167 <c0n200>
2011-11-25T00:00:30-08:00 patterndb at catamount.comp.uvic.ca user.warning somehost.uvic.ca ][somehost.uvic.ca][mmfs: Fri Nov 25 00:00:29.621 2011: Connected to
172.20.107.23 nestor0167 <c0n200>
# -----------------------------------

I would expect the output file to read

# -----------------------------------
2011-11-25T00:00:30-08:00 somehost.uvic.ca user.warning mmfs: ][mmfs][Fri Nov 25 00:00:29.618 2011: Accepted and connected to 172.20.102.38 hermes0080 <c0n350>
2011-11-25T00:00:30-08:00 somehost.uvic.ca user.warning mmfs: ][mmfs][Fri Nov 25 00:00:29.620 2011: Connecting to 172.20.107.23 nestor0167 <c0n200>
2011-11-25T00:00:30-08:00 somehost.uvic.ca user.warning mmfs: ][mmfs][Fri Nov 25 00:00:29.621 2011: Connected to 172.20.107.23 nestor0167 <c0n200>
# -----------------------------------


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.


More information about the syslog-ng mailing list