Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng

Edited /etc/squid3/squid.conf and added the following line:

access_log syslog squid

Logs are being written but the program name "squid" is being added in brackets, while for other logs the program name isn't

Jul 25 17:26:23 ubuntuserver kernel: 
Jul 25 17:26:24 ubuntuserver named[1231]:
Jul 25 16:17:56 ubuntuserver (squid):

I assume this is squid3 telling syslog-ng "my program name is (squid)" and am unable to find anywhere to configure this differently as I would like to remove the brackets.

In syslog-ng's conf I've had a play with outputting the log and the $PROGRAM macro definitely contains the brackets too, which indicates it is coming from squid as this page indicates the below: http://www.balabit.com/sites/default/files/documents/syslog-ng-admin-guide_en.html/reference_macros.html

PROGRAM: The name of the program sending the message. Note that the content of the $PROGRAM variable may not be completely trusted as it is provided by the client program that constructed the message.

How can I remove the brackets?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You can use a rewrite rule to fix up the program name anyway you want it:

rewrite r_brackets {
    subst ("\((.+)\)", "$1", value (PROGRAM));
};

...

log { source (...); ....; rewrite (r_brackets); destination (...); ...; };
share|improve this answer
    
Ok had a play with regex in syslog-ng - it does it's own backslash escaping so you need to double \\ the escapes. So the regex that works becomes "\\((.+)\\)" –  Nick Sturgess Jul 26 '12 at 1:18
    
Right. You can also choose which regex style you want to use, pcre or posix (if syslog-ng was compiled with PCRE support, that is): subst (...., value (PROGRAM) type (xxx)); where 'xxx' is either posix or pcre. I believe posix is the default. –  mghocke Jul 26 '12 at 14:36

Try following the forum post HERE - it outlines how to configure Squid with LogZilla using syslog-ng. In the post, the configs used are sending the program name properly.

share|improve this answer
    
Unfortunately this doesn't work. I've a debian etch box running squid 2.6 and it doesn't send through the brackets –  Nick Sturgess Jul 26 '12 at 0:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.