On Mon, Apr 1, 2013 at 9:33 AM, Андрей Шевченко <[email protected]> wrote: > Hi all. > > I am using srlog2 to transport logs to the central server and the problem is > that srlog adds tai64nlocal timestamp to every standart syslog message. > > Here is an example: > @4000000051594d5228e8290c Apr 1 15:03:14 xxx su: BAD SU yyy to toor on > /dev/pts/0 > @4000000051594d54207e0034 Apr 1 15:03:16 xxx su: yyy to toor on /dev/pts/0 > > I believe, i just need a custom predecoder, to cut out tai64 timestamp and > then process as a usual syslog message. > Is there any ways to achive that? >
You'll have to modify the source. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
