Syslogd: translate facility on log messages going to a server

Question

I want to send some log messages out to a remote log server, and change the facility on them to a configured value so the log server can tell more easily that they came from my hardware. That is, all logs coming out of my machine are, say, local3, regardless of their original facility.

Can I do this with vanilla syslogd on FreeBSD, or using some other implementation?

Answer 1

Apparently it is not possible to do this with FreeBSD syslog. I've scoured the man page for any clue and found nothing.

According to this web page you can do it with syslog-ng, but we're not in a position to switch.

Answer 2

As Andrew itself found out, syslog-ng would be the best option.

But I think there might be a kludgish way to do the trick even with vanilla FreeBSD syslogd. It seems to be possible to pipe log entries to an external program: you can then pipe the messages to logger and set the wanted facility & priority with it and ask logger to send the log entry to your log server.

logger probably adds its own timestamps etc to every log entry, so you might want to sed or whatever the original timestamps away.

Yes, I know, this approach would be ugly as hell and belongs to Don't Try This Anywhere category, but still it might work.

Answer 3

I think you trying to do something strange. You can easily sort messages in syslog depending on hostname they came from.

See man syslog.conf:

 A hostname specification of the form #+hostname or +hostname means
 the following blocks will be applied to messages received from the speci-
 fied hostname.  Alternatively, the hostname specification #-hostname or
 -hostname causes the following blocks to be applied to messages from
 any host but the one specified.  If the hostname is given as @, the
 local hostname will be used.  As for program specifications, multiple
 comma-separated values may be specified for hostname specifications.