Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to parse some custom (network appliance) syslog files to create my own formatted output.

As I am new to syslog-ng & patterndb I have been trying to build an example using the documentation - my work so far is here: https://gist.github.com/linickx/8002981

In the example, I would like to read the syslog file (testfile.log):

Accepted password for sampleuser from port 42156 ssh2
Accepted password for user from port 4256 ssh2

And output just a list of usernames & ip addresses, like:


To parse the log file I have created the following patterndb (example.xml):

<patterndb version='4' pub_date='2010-10-17'>
    <ruleset name='ssh' id='123456678'>
                <rule provider='me' id='182437592347598' class='system'>
                        <pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                            <test_message program="ssh">Accepted password for sampleuser from port 42156 ssh2</test_message>
                                <test_value name="SSH.AUTH_METHOD">password</test_value>
                                <test_value name="SSH_USERNAME">sampleuser</test_value>
                                <test_value name="SSH_CLIENT_ADDRESS"></test_value>
                                <test_value name="SSH_PORT_NUMBER">42156</test_value>

However when I use the SSH_USERNAME & SSH_CLIENT_ADDRESS variables in my syslog-ng.conf

destination test_output {
                template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; \n")

--[ full version can been seen in the GIST ]--

The output file (output.log) is empty

; ;
; ;

Is there some hierarchy or special way to use custom or patterndb variables in syslog-ng.conf that I am missing?

Thanks in Advance!

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.