On Thu, Apr 25, 2013 at 10:12 AM, C. L. Martinez <[email protected]>wrote:
> Hi all, > > I am using new configuration format to forward syslog logs from a rsyslog > 7.2.x server to another syslog-ng instance. > > Problem appears with the RSYSLOG_ForwardFormat, message appears truncated > in syslog-ng side. For example: > > 1366884576 172.28.0.2 date=2013-04-25 unknown time=12:09:36 > devname=FWALL01 device_id=FG0032222211 log_id=0022000003 type=traffic > subtype=violation pri=warning status=deny vd="root" src=10.5.37.52 > srcname=10.5.37.52 src_port=500 dst=1.1.1.1 dstname=1.1.1.1 dst_port=500 > service=500/udp proto=17 app_type=N/A duration=0 rule=0 policyid=0 > identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 > shaper_sent_name="N/A" shaper_rcvd_name="N/A" perip_name="N/A" vpn="N/A" > src_int="switch" dst_int="port16" SN=a245556353 app="N/A" app_cat="N/A" > user="N/A" group="N/A" carrier_ep="N/A" > > When result needs to be: > > 1366884576 172.28.0.2 date=2013-04-25 time=12:09:36 > devname=FWALL01 device_id=FG0032222211 log_id=0022000003 type=traffic > subtype=violation pri=warning status=deny vd="root" src=10.5.37.52 > srcname=10.5.37.52 src_port=500 dst=1.1.1.1 dstname=1.1.1.1 dst_port=500 > service=500/udp proto=17 app_type=N/A duration=0 rule=0 policyid=0 > identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 > shaper_sent_name="N/A" shaper_rcvd_name="N/A" perip_name="N/A" vpn="N/A" > src_int="switch" dst_int="port16" SN=a245556353 app="N/A" app_cat="N/A" > user="N/A" group="N/A" carrier_ep="N/A" > > I have tried to define different templates format without luck .... Any > idea how to fix this?? > Oops sorry for the noise ... Problem was on syslog-ng side ... Thanks ... _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
