[syslog-ng] Parsing Cisco FWSM with device-id
mcholste at gmail.com
Wed Oct 5 20:00:48 CEST 2011
So I have a customer who has enabled the device-id configuration
directive on his FWSM, and that means that instead of this from a
<174>%FWSM-6-302013: Built inbound TCP...
it sends this:
<174>FWSMHostName %FWSM-6-30203: Built inbound TCP...
This means that the program name does not get properly parsed as
syslog-ng pushes it into the msg field. If I can't convince the
customer to remove the device-id setting, what's the least
CPU-intensive way of coping with this so that program and msg are set
More information about the syslog-ng