[syslog-ng] syslog-ng multiple VRF

[PÁSZTOR György]

Hi,

"Alexandre Santos" <alexandre.rosas.santos at gmail.com> írta 2020-07-24 11:03-kor:
> Any plans to make syslog-ng VRF aware?

Can you define your expectations as vrf-aware?

To make things clear, I suggest to provide a pcap from two different vrfs,
or one pcap with two syslog packet in it, and an example what gots into the
logfile in both case, and what would be your exepctation.
Or if they should not get to a logfile, than define that.
This kind of approach helps a lot:
- describe what is your current input (with examples from two different vrfs)
- describe the behaviour what you are experiencing now (two logfile part,
  what you got out of the example messages)
- define the behaviour what you expect. (eg. another two txt files, but now
  with the content you would see in them)
This is defining behaviour.

If you copy message parts into the body of the message, that will be
displayed in various ways depending on the mailer.
I suggest for this few exceptions to use attachments.
I'm not aware of the mailinglist would filter attachments out.
A don't think one or two small pcap and txt attachment would violate coc
here.

Or if you don't want to "spam" mailinglist with attachments, that is still
an option that you open an issue on github and attach the files there
Than we discuss the subject here, in that case you only have to shere the
link to your issue here.

I worked with ciscos earlier, though not that deep that I had to use vrfs,
but still don't understand, what is your expectation here.
Also, if you can openly share what models / ios versions you are using, it
could help a lot. Eg. if that model supports ietf syslog protocol, maybe we
don't even need to hack an old legacy format (rfc 3164), what cisco
implements in so creative ways that it isn't even consistent with
themselves.

Cheers,
Gyu