> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Peter Horvath > Sent: Thursday, October 20, 2011 6:12 PM > To: rsyslog-users > Subject: [rsyslog] program name limitation for remote logging > > I am useing the following rules to send apache log perfectly tagged to > syslog and than to remote logging server over tcp 514. > On local servers syslog receives and stores messages perfectly however > on the remote server only the first 32 character of program name > appear in the syslog. > > clients: > apache conf: > ErrorLog "|/usr/bin/logger -p local6.warn -t > httpd_eurwebtest01.eurweb.xxxxx.com" > CustomLog "|/usr/bin/logger -p local6.info -t > httpd_eurwebtest01.eurweb.xxxxx.com" combined > > server: > rsyslog conf: > $template ApacheLogFormat,"%msg:2:10000%\n" > $template > local6error,"/srv/log/apache2/%programname:7:50%_error_log.%$YEAR%%$MON > TH%%$DAY%" > $template > local6access,"/srv/log/apache2/%programname:7:50%_access_log.%$YEAR%%$M > ONTH%%$DAY%" > > if $syslogfacility-text == 'local6' and $syslogseverity-text == 'warn' > and $programname startswith 'httpd' then -?local6error;ApacheLogFormat > #& ~ > > if $syslogfacility-text == 'local6' and $syslogseverity-text == 'info' > and $programname startswith 'httpd' then > -?local6access;ApacheLogFormat > #& ~ > > Any idea ? Is there a limitation on program name if you send it to a > remote host?
The relevant RFCs limit tag size to 32 octets. So the default template does this as well. You can create a custom template that does not have this limitation. Rsyslog can process longer tags. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
