1

I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to the end of the event. I tried the following:

source src {
       internal();
       unix-dgram("/dev/log");
};


destination editredirect { udp("10.30.38.115" port(514) template("<$PRI> $DATE $HOST $MSG MyMark\n") ); };

log { source(src); destination(editredirect); };

But it doesn't work. On the remote host, I don't receive these messages at all. Truth be told, I don't receive them even if I remove the template. The remote host is configured to accept incoming messages and it really does.

So, my question is how to tune syslog-ng.conf so that I could change messages before sending them to the remote host.

Update: solved

Here is how redirection is now organized:

Remote machine:

source src {
        #
        # include internal syslog-ng messages
        # note: the internal() soure is required!
        #
        internal();

        #
        # the default log socket for local logging:
        #
        unix-dgram("/dev/log");

        #
        # uncomment to process log messages from network:
        #
        udp(ip("0.0.0.0") port(514));
        tcp(ip("0.0.0.0") port(1470)); };

Local machine:

source src {
        #
        # include internal syslog-ng messages
        # note: the internal() soure is required!
        #
        internal();

        #
        # the following line will be replaced by the
        # socket list generated by SuSEconfig using
        # variables from /etc/sysconfig/syslog:
        #
        #unix-dgram("/dev/log");
        unix-stream("/dev/log");

        #
        # uncomment to process log messages from network:
        #
        #udp(ip("0.0.0.0") port(514));
};


destination editredirect { tcp("10.30.38.115" port(1470) template("<$PRI> $DATE $HOST $MSG MyMark\n")); };
log { source(src); destination(editredirect); };
3
  • unix-dgram is used for BSD's, use unix-stream instead Also, check this out : oreilly.com/pub/h/1366 it may contain answers for you.
    – m0ntassar
    Mar 12, 2012 at 16:26
  • m0ntassar, thanks. Actially, id didn't help. I still have the same error on the local machine: Connection broken to AF_INET(10.30.38.115:514), reopening in 60 seconds
    – user54614
    Mar 12, 2012 at 16:36
  • @user54614: Instead of updating your question, you can answer your question and accept it.
    – Khaled
    Mar 12, 2012 at 16:55

2 Answers 2

0

Try this

source src {

        internal();
        unix-stream("/dev/log");
};


destination editredirect { tcp("10.30.38.115" port(1470) template("$FULLDATE $PROGRAM  $MSGONLY MyMark \n") template_escape(no)); };
log { source(src); destination(editredirect); };
0

Here is how redirection is now organized:

Remote machine:

source src {
    #
    # include internal syslog-ng messages
    # note: the internal() soure is required!
    #
    internal();

    #
    # the default log socket for local logging:
    #
    unix-dgram("/dev/log");

    #
    # uncomment to process log messages from network:
    #
    udp(ip("0.0.0.0") port(514));
    tcp(ip("0.0.0.0") port(1470)); };
Local machine:

source src {
    #
    # include internal syslog-ng messages
    # note: the internal() soure is required!
    #
    internal();

    #
    # the following line will be replaced by the
    # socket list generated by SuSEconfig using
    # variables from /etc/sysconfig/syslog:
    #
    #unix-dgram("/dev/log");
    unix-stream("/dev/log");

    #
    # uncomment to process log messages from network:
    #
    #udp(ip("0.0.0.0") port(514));

};

destination editredirect { tcp("10.30.38.115" port(1470) template("<$PRI> $DATE $HOST $MSG MyMark\n")); };
log { source(src); destination(editredirect); };

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .