[syslog-ng] Syslog-ng Message Format

[Balazs Scheidler]

Unfortunately your question might seem simple, but really isn't. You are
mentioning rfc5425 but in what way is this rfc5425?

Is the client device sending it in that mode, due to a configuration
setting?

Can you show an example for this "rfc5425" message being incorrect? I would
need to see how you configured syslog-ng to receive those messages, and the
kind of device plus its settings. Unfortunately various devices mess up
syslog in a lot of different ways, and although syslog-ng is able to cope
with a lot of scenarios, it might not be all of them.

So please describe:
* The device sending the log, preferably with log related settings
* The syslog-ng source declaration that you use to receive these messages
* The syslog-ng destination declaration (and not just the template) that
you use to send out the message
* The end result in the consumer.

Please try to explain what you see and what you'd expect at each state, as
listed above.

If you want,we could possibly get to our gitter channel where things can be
discussed more interactively.

Balázs


On Mon, Nov 7, 2022, 13:23 Maurya, Shivani <shivani.maurya at intel.com> wrote:

> Hi,
>
>
>
> Please find the details below on the current template which we use for
> syslog-ng messages –
>
>
>
> *FORMAT – *template("${R_ISODATE} ${FULLHOST_FROM} ${SOURCEIP}
> ${PRIORITY} ${FACILITY} ${PROGRAM} ${MSG}\n")
>
> *EXAMPLE -* 2022-11-07T12:13:05+00:00 FQDN IP notice local7 6266821 Nov 7
> 12:15:58.043: *%ILPOWER-5-DETECT*: Interface Gi1/0/16: Power Device
> detected: Cisco PD
>
> In the above example you can see the messages are prefixed with the %TAG.
> However with * rfc 5425*, the messages are not prefixed with %TAG & it’s
> a plain message.
>
>
>
> Please let me know how to prefix the *rfc 5425 *messages with %TAG.
>
>
>
> Regards,
>
> Shivani Maurya
>
>
>
> *From:* syslog-ng <syslog-ng-bounces at lists.balabit.hu> *On Behalf Of *Balazs
> Scheidler
> *Sent:* Monday, November 7, 2022 5:41 PM
> *To:* Syslog-ng users' and developers' mailing list <
> syslog-ng at lists.balabit.hu>
> *Subject:* Re: [syslog-ng] Syslog-ng Message Format
>
>
>
> Yes, there's.
>
>
>
> It would be great if you could show us how you send your output to the log
> consumer today, it would be easier to suggest solutions based on that.
>
>
>
> On Mon, Nov 7, 2022, 12:09 Maurya, Shivani <shivani.maurya at intel.com>
> wrote:
>
> Hi All,
>
>
>
> With the older Syslog-ng RFC format (*rfc 3164*), the devices used to
> send the syslog messages in the below format –
>
>
>
> %TAG TIMESTAMP FULLHOSTFROM SEVERITY MSG
>
> *Example -* %SYSMGR-2-NON_VOLATILE_DB_INODE_FULL:2022 Nov 7 03:54:30 MST:
> SYSMGR-2-NON_VOLATILE_DB_INODE_FULL: System non-volatile inode storage
> usage is unexpectedly high at 96
>
>
>
> But with the new syslog-ng RFC format (*rfc 5425*), the devices send the
> syslog messages in below format –
>
>
>
> TIMESTAMP FULLHOSTFROM SEVERITY MSG
>
>
>
> Is there a way to update/format the messages (rfc 5424) to be pre-fixed
> with %TAG ?
>
>
>
> Regards,
>
> Shivani Maurya
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20221107/4bd887ff/attachment.htm>