Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am reading through some syslog-ng documentation, and in the section about filter functions, it says that the program() filter matches...

...messages by using a regular expression against the program name field of log messages.

The documentation also includes similar definitions for other filter functions.

How is the program name field set in a log message? Is there some documentation somewhere which summarises this for the various fields? I couldn't find it in the documentation I have ("The syslog-ng Administrator Guide").

share|improve this question

The program name field is set by the application sending the log message. If you want to override this for some reason, you can use the program_override() option in the syslog-ng source definition. I am not sure which syslog-ng versions support this option, it is surely available in 3.0 and later.



share|improve this answer

From man 3 syslog:

   #include <syslog.h>

   void openlog(const char *ident, int option, int facility);
   void syslog(int priority, const char *format, ...);
   void closelog(void);

   openlog()  opens a connection to the system logger for a program.  
   The string pointed to by ident is prepended to every message, 
   and is typically set to the program name.

Program name is set inside code of the program using the system logging facility.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.