> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Monday, May 21, 2012 8:30 PM > To: rsyslog-users > Subject: Re: [rsyslog] facility rewriting > > On Mon, 21 May 2012, Mohacsi Janos wrote: > > > Dear Colleagues, > > > > Is there a possible with rsyslog to rewrite the logging facility when a > > sending to a remote syslog server? > > > > Problem: > > on host1 local1 and local2 facility is used to logging. Application is > > sending logs via syslog via local1 facility. The logs from host1 with local1 > > facility should be send to host2 with local2 facility. > > > > The local2 cannot be used by application on host1, since there is another > > application with hard-coded local2 facility. > > > > The local1 cannot be used on host2 since it is hard-coded - and using several > > other systems. > > > > Is it possible to mapping/rewriting facility during the syslog sending? > > Template can be used for that purpose? Any recipe available for such rewrite? > > There is no clean way to do this. you can do this with a template, but the > problem is that the facility and priority are combined into a single > number. As such, each priority you want to set will need a different > template.
Yeah, it's clumpsy. I think that question comes up every now and then. I should find a better way to do it. A quick way may be a message modification module, a better one to provide write-access to at least a limited set of message properties. Will see if I can fit it in... To the OP: it may be worth writing a custom message modification module. It's actually not that much work if you use an existing one as a template. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
