Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to parse some custom (network appliance) syslog files to create my own formatted output.

As I am new to syslog-ng & patterndb I have been trying to build an example using the documentation - my work so far is here:

In the example, I would like to read the syslog file (testfile.log):

Accepted password for sampleuser from port 42156 ssh2
Accepted password for user from port 4256 ssh2

And output just a list of usernames & ip addresses, like:


To parse the log file I have created the following patterndb (example.xml):

<patterndb version='4' pub_date='2010-10-17'>
    <ruleset name='ssh' id='123456678'>
                <rule provider='me' id='182437592347598' class='system'>
                        <pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                            <test_message program="ssh">Accepted password for sampleuser from port 42156 ssh2</test_message>
                                <test_value name="SSH.AUTH_METHOD">password</test_value>
                                <test_value name="SSH_USERNAME">sampleuser</test_value>
                                <test_value name="SSH_CLIENT_ADDRESS"></test_value>
                                <test_value name="SSH_PORT_NUMBER">42156</test_value>

However when I use the SSH_USERNAME & SSH_CLIENT_ADDRESS variables in my syslog-ng.conf

destination test_output {
                template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; \n")

--[ full version can been seen in the GIST ]--

The output file (output.log) is empty

; ;
; ;

Is there some hierarchy or special way to use custom or patterndb variables in syslog-ng.conf that I am missing?

Thanks in Advance!

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.