[syslog-ng] Syslog-ng header & rfc5424

[Florian Goulais]

Hi again.
I just tried to send the example of syslog message in your administration
guide and I've got the same effect :
Reformatting the message.

I've no "no-parse" I'm my config file, but syslog-ng drop pri, and the
pseudo header(time&host) and put everything into $MSG.
Any idea ?

Le ven. 19 juil. 2019 à 14:15, Fabien Wernli <wernli at in2p3.fr> a écrit :

> On Fri, Jul 19, 2019 at 01:58:36PM +0200, Florian Goulais wrote:
> > I just try to understand why syslog add a non standardized header.
>
> syslog-ng doesn't "add" anything. What it does is parse input, and forma
> the message object depending on the input and output drivers.
>
> If you use the syslog() input, it tries to parse rfc3164/rfc5424.
> If you use the file() output, it formats using time, host, program,
> message.
>
> If you want to track everything unparsed, use flags(no-parse) in the input,
> and template("$MSG") in the output.
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190719/adcbc757/attachment.html>