In my experience, syslog-ng sends out logs in a format that does not comply with
the RFC standards, rsyslog does not have a parser to correct this.
On the rsyslog server, log a few of the messages using RSYSLOG_DebugFormat and
look at the raw message. That will show what the syslog-ng server is sending.
You need to change the format that the syslog-ng server is sending to something
that rsyslog can understand (or get a parser for rsyslog to understand the
default syslog-ng format written)
David Lang
On Fri, 18 Oct 2013, Roberto Giordani wrote:
Hello,
I'm trying to send a log file from a syslog-ng client to Rsyslog server.
This is my configuration on client and server
On client syslog-ng 3.1:
source s_file_sslaccess {
file("/var/log/httpd/logs/sslaccess_log.2013-10-18" flags(no-parse)
default-facility("local6") default-priority("debug") tags("sslaccess") );
};
destination remote_fsp01trnr {
tcp("10.10.1.10" port(10516) keep-alive(yes) );
};
log {
source(s_file_sslaccess);
destination(remote_fsp01trnr);
};
On Server rsyslog 7:
template(name="filename" type="string"
string="/rsyslog-data/%$!path%/%$!server%/%syslogtag%.log")
if $fromhost-ip == "10.10.1.4" then {
set $!path="TestLog";
set $!server="http01";
local6.debug action(type="omfile" DirOwner="tom" DirCreateMode="0750"
FileCreateMode="0444" DynaFile="filename" )
stop
}
On Server the destination directory is formed by multiple file named with a
number.log
10.log 12.log 14.log 18.log 20.log 22.log 25.log 28.log 30.log 39.log
40.log 5.log 74.log 8.log
11.log 13.log 15.log 1.log 21.log 24.log 26.log 2.log 34.log 3.log
4.log 6.log 7.log 9.log
How can create a single file named with tag selected on client conf? (Ex.
sslaccess.log)
Regards,
Roberto.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
