Hi Li, Graylog is parsing syslog messages according to the syslog protocol standard(s), so it will not repeat the date and the hostname on the start of each syslog message but fill the "timestamp" and "source" message fields accordingly.
Also see https://github.com/Graylog2/graylog-guide-syslog-linux/blob/master/README.md#syslog-ng for configuration instructions for syslog-ng. Cheers, Jochen On Friday, 13 January 2017 18:15:40 UTC+1, Li Li wrote: > > Hi, all, > > A portion of logs received from syslog-ng is missing, for example, logs > entries expected are: > > Jan 12 17:04:22 Lab-PA5020.lab.hsc.net.ou.edu 1,2017/01/12 > 17:04:21,0011C102743,TRAFFIC,start,1........ > > But in graylog, "Jan 12 17:04:22 Lab-PA5020.lab.hsc.net.ou.edu > 1,2017/01/12" is missing, logs seen in graylog start with > "17:04:21,0011C102743,TRAFFIC,start,1........" > > when I have graylog writing to a file, the logs appear to be correct, ie, > nothing is missing. > > My syslog-ng version is 3.7.3, graylog version is 2.0.3. > > Can anyone give some suggestions? Your help would be greatly appreciated! > > Thanks, > -Li > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/927aff99-cba4-41a5-b2a0-7c6a0ca90637%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
