you can't do that unless the log lines are in the proper syslog network
transport format
If you don't want the rsyslog properties there, then you need to substatute
other values, you can't just leave them out.
when the receiving rsyslog server tries to parse the message, it will attempt to
do the right thing? but it has to make up date to do so, and will probably end
up eating the first word or two of the message (having them become hostname and
syslogtag I think)
what is it that you are wanting to avoid from the rsyslog properties?
David Lang
On Wed, 23 Apr 2014, Brian Huntington wrote:
Hello Rainer, thanks for your online video tutorials. I found them very
useful.
If my template violates the format, I'm willing to change it. My only
requirement is that I'm not prepending rsyslog property values to the log
lines. If preferable, I'd like to send the data exactly the same as it's
generated by the application (Apache)
I turned on the receiver's debug, and these are the results:
1) When my client configuration reads:
local3.* <IP>:514
all configured input file logging is sent to the log server. The debugger
logs no new data
2) When my client configuration reads:
$template msgOnlyTemplate,"%syslogtag%%msg%\n"
if $syslogfacility-text == 'local3' then @156.36.38.61:514;msgOnlyTemplate
& ~
no configured input file logging is sent to the log server. The debugger
records the following:
inputname: rsyslogd rawmsg: ' [origin software="rsyslogd" swVersion="5.10.1"
x-pid="17085" x-info="http://www.rsyslog.com";] start'
Debug line with all properties:
FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>',
PRI: 15,
syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME:
'auditmanager', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Apr 23 14:56:22', STRUCTURED-DATA: '-',
msg: ' Received wakeup signal before sleep finished'
escaped msg: ' Received wakeup signal before sleep finished'
inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: Received
wakeup signal before sleep finished'
Debug line with all properties:
FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>',
PRI: 15,
syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME:
'auditmanager', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Apr 23 14:56:24', STRUCTURED-DATA: '-',
msg: ' last message repeated 2 times'
escaped msg: ' last message repeated 2 times'
inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: last message
repeated 2 times'
[truncated]
Debug line with all properties:
FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>',
PRI: 31,
syslogtag '.vasac_helper[17173]:', programname: '.vasac_helper', APP-NAME:
'.vasac_helper', PROCID: '17173', MSGID: '-',
TIMESTAMP: 'Apr 23 14:56:35', STRUCTURED-DATA: '-',
msg: ' Unable to set daemon API context to default to memory ccache in
_local_vas_init, Error was Invalid VAS context, no available error message'
escaped msg: ' Unable to set daemon API context to default to memory ccache
in _local_vas_init, Error was Invalid VAS context, no available error
message'
inputname: imuxsock rawmsg: '<31>Apr 23 14:56:35 .vasac_helper[17173]:
Unable to set daemon API context to default to memory ccache in
_local_vas_init, Error was Invalid VAS context, no available error message'
followed by
msg: ' Received wakeup signal before sleep finished'
msg: ' last message repeated 2 times'
several times in a row
--
View this message in context:
http://rsyslog-users.1305293.n2.nabble.com/imfile-templates-tp7585270p7585274.html
Sent from the rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
