Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to the end of the event. I tried the following:

source src {
       internal();
       unix-dgram("/dev/log");
};


destination editredirect { udp("10.30.38.115" port(514) template("<$PRI> $DATE $HOST $MSG MyMark\n") ); };

log { source(src); destination(editredirect); };

But it doesn't work. On the remote host, I don't receive these messages at all. Truth be told, I don't receive them even if I remove the template. The remote host is configured to accept incoming messages and it really does.

So, my question is how to tune syslog-ng.conf so that I could change messages before sending them to the remote host.

Update: solved

Here is how redirection is now organized:

Remote machine:

source src {
        #
        # include internal syslog-ng messages
        # note: the internal() soure is required!
        #
        internal();

        #
        # the default log socket for local logging:
        #
        unix-dgram("/dev/log");

        #
        # uncomment to process log messages from network:
        #
        udp(ip("0.0.0.0") port(514));
        tcp(ip("0.0.0.0") port(1470)); };

Local machine:

source src {
        #
        # include internal syslog-ng messages
        # note: the internal() soure is required!
        #
        internal();

        #
        # the following line will be replaced by the
        # socket list generated by SuSEconfig using
        # variables from /etc/sysconfig/syslog:
        #
        #unix-dgram("/dev/log");
        unix-stream("/dev/log");

        #
        # uncomment to process log messages from network:
        #
        #udp(ip("0.0.0.0") port(514));
};


destination editredirect { tcp("10.30.38.115" port(1470) template("<$PRI> $DATE $HOST $MSG MyMark\n")); };
log { source(src); destination(editredirect); };
share|improve this question
    
unix-dgram is used for BSD's, use unix-stream instead Also, check this out : oreilly.com/pub/h/1366 it may contain answers for you. –  m0ntassar Mar 12 '12 at 16:26
    
m0ntassar, thanks. Actially, id didn't help. I still have the same error on the local machine: Connection broken to AF_INET(10.30.38.115:514), reopening in 60 seconds –  user54614 Mar 12 '12 at 16:36
    
@user54614: Instead of updating your question, you can answer your question and accept it. –  Khaled Mar 12 '12 at 16:55
    
Khaled, thanks, I will try. –  user54614 Mar 14 '12 at 14:15

2 Answers 2

Try this

source src {

        internal();
        unix-stream("/dev/log");
};


destination editredirect { tcp("10.30.38.115" port(1470) template("$FULLDATE $PROGRAM  $MSGONLY MyMark \n") template_escape(no)); };
log { source(src); destination(editredirect); };
share|improve this answer
up vote 0 down vote accepted

Here is how redirection is now organized:

Remote machine:

source src {
    #
    # include internal syslog-ng messages
    # note: the internal() soure is required!
    #
    internal();

    #
    # the default log socket for local logging:
    #
    unix-dgram("/dev/log");

    #
    # uncomment to process log messages from network:
    #
    udp(ip("0.0.0.0") port(514));
    tcp(ip("0.0.0.0") port(1470)); };
Local machine:

source src {
    #
    # include internal syslog-ng messages
    # note: the internal() soure is required!
    #
    internal();

    #
    # the following line will be replaced by the
    # socket list generated by SuSEconfig using
    # variables from /etc/sysconfig/syslog:
    #
    #unix-dgram("/dev/log");
    unix-stream("/dev/log");

    #
    # uncomment to process log messages from network:
    #
    #udp(ip("0.0.0.0") port(514));

};

destination editredirect { tcp("10.30.38.115" port(1470) template("<$PRI> $DATE $HOST $MSG MyMark\n")); };
log { source(src); destination(editredirect); };
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.