Hi all, I am using new configuration format to forward syslog logs from a rsyslog 7.2.x server to another syslog-ng instance.
Problem appears with the RSYSLOG_ForwardFormat, message appears truncated in syslog-ng side. For example: 1366884576 172.28.0.2 date=2013-04-25 unknown time=12:09:36 devname=FWALL01 device_id=FG0032222211 log_id=0022000003 type=traffic subtype=violation pri=warning status=deny vd="root" src=10.5.37.52 srcname=10.5.37.52 src_port=500 dst=1.1.1.1 dstname=1.1.1.1 dst_port=500 service=500/udp proto=17 app_type=N/A duration=0 rule=0 policyid=0 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name="N/A" shaper_rcvd_name="N/A" perip_name="N/A" vpn="N/A" src_int="switch" dst_int="port16" SN=a245556353 app="N/A" app_cat="N/A" user="N/A" group="N/A" carrier_ep="N/A" When result needs to be: 1366884576 172.28.0.2 date=2013-04-25 time=12:09:36 devname=FWALL01 device_id=FG0032222211 log_id=0022000003 type=traffic subtype=violation pri=warning status=deny vd="root" src=10.5.37.52 srcname=10.5.37.52 src_port=500 dst=1.1.1.1 dstname=1.1.1.1 dst_port=500 service=500/udp proto=17 app_type=N/A duration=0 rule=0 policyid=0 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name="N/A" shaper_rcvd_name="N/A" perip_name="N/A" vpn="N/A" src_int="switch" dst_int="port16" SN=a245556353 app="N/A" app_cat="N/A" user="N/A" group="N/A" carrier_ep="N/A" I have tried to define different templates format without luck .... Any idea how to fix this?? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
