Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the system:

  • SUSE Linux Enterprise Server 10
  • syslog-ng with predefined syslog-ng.conf
  • messages in /var/log/messages look like:

Feb 8 09:29:53 sles1 sshd[17529]: Accepted keyboard-interactive/pam for root from port 4855 ssh2

What I need:

  • to log event severity/facility. For instance, add <PRI> at the beginning of the message:

<15> Feb 8 09:29:53 sles1 sshd[17529]: Accepted keyboard-interactive/pam for root from port 4855 ssh2

My question is:

How to change syslog-ng.conf to enable this kind of logging?


share|improve this question
up vote 5 down vote accepted

It sounds like you want to rewrite your logfiles in a specific format. The link has the details on how to tell syslog-ng to do that :)

share|improve this answer
Thanks, it helped! – user31462 Feb 8 '10 at 17:39

Based on some quick reading I think you want to use the syslog() driver, which si described in section 8.1.6 of the Syslog-ng Administrator's guide.

I hope this helps, if I find anything more, I'll let you know.

I think the syslog() driver is meant to be used with the source declaration. so where I have
source external { udp(); };

You might use
source external { syslog(transport("udp")); };

I don't have a suitable testing environment to try this out on, but I think this is what you want to do, if I understand your question correctly.

I went back and looked and it turns out there's a macro you can use in your destination called TAG.

destination d_all { file("/log/$FACILITY.log" group("users") template_escape(no) template("$TAG $PRIORITY $S_DATE $HOST $MSG\n")); };
These macros are defined around page 218 of the admin guide.

share|improve this answer
Truth be told, I failed to find any real-life example of changes you need to make for this stuff. – user31462 Feb 8 '10 at 15:34
Actually, I don't have source external { udp(); }; in my config. What I have is slightly different: source src { internal(); unix-dgram("/dev/log"); }; – user31462 Feb 8 '10 at 16:36

If you have a destination configured as so:

destination syslog-consumer { unix-stream("/var/run/syslog-output"); };

syslog messages headed to syslog-consumer get sent to that socket in the format you want.

You'll just need to setup something to listen to that socket and write to a file.

share|improve this answer
Is there some other way without listening to the socket? I wonder why can't I add something to this declaration ... destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; ... to add <PRI> field in /var/log/messages... – user31462 Feb 8 '10 at 16:32
I posted this particular method since my log consumer just listened to the socket without any intermediate files. Thought it might fit your need :) – MikeyB Feb 8 '10 at 18:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.