Re: Forwarding locally stored RAW messages
Evan Rempel <[email protected]> Thu, 13 Apr 2023 06:18:40 -0700
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
It really depends on the format of your stored message files. If any
information is missing, then you can't expect to recreate the original
source messages.
We store the messages in a format defined as
template("<$PRI>$ISODATE $FULLHOST $FACILITY.$LEVEL $MSGHDR$MESSAGE\n");
which looks like
2023-04-13T06:15:01.613-07:00 my.host.name cron.info CROND[662460]:
(root) CMD (/usr/local/sbin/fscheck)
These messages can be read back with a no-parse option from a named pipe
source s_replay { pipe("/var/log/syslog.pipes/replay"
log_iw_size(100000) log_fetch_limit(5000) flags(no-parse) ); };
and parsed with a pattern database (attached) with
parser p_rawsyslog {
db_parser(
file("/usr/local/etc/syslog-ng/patterndb.d/reprocess.xml")
inject_mode(internal)
);
};
log {
source(s_replay);
parser(p_rawsyslog);
...
};
Then sent to any destination with templated values from the parsing.
template t_replay { template("<$pri>$parsedate $parsehost
$parsemessage\n"); template_escape(no); };
message files can be fed into this by the command
cat log.file.name >> /var/log/syslog.pipes/replay
Hope that helps as a starting point.
Evan
On 2023-04-13 04:45, Dragan Zecevic wrote:
>
> Hi,
> we have syslog-ng Open Source Edition 3.33 and we are storing syslog
> messages from some systems into log files locally on a partition on
> syslog-ng server.
> Each day those log files are compressed.
> In order to better analyze some logs if needed we would like to
> extract some log files and ingest them to SIEM.
>
> Is it possible to make some forwarder that will read these RAW syslog
> messages from a log file and send them via syslog to SIEM?
>
> Thank you.
>
> Br,
> Dragan
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
reprocess.xml
(text/xml, 46.8 KB)
<patterndb version="4" pub_date="2009-09-01">
<ruleset name="all" id="RS-805e9c27-ffce-486e-8d65-05d1cbe8a68d">
<rules>
<rule id="kern.emerg" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">0</value>
</values>
</rule>
<rule id="kern.alert" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">1</value>
</values>
</rule>
<rule id="kern.crit" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">2</value>
</values>
</rule>
<rule id="kern.err" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">3</value>
</values>
</rule>
<rule id="kern.warning" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">4</value>
</values>
</rule>
<rule id="kern.notice" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">5</value>
</values>
</rule>
<rule id="kern.info" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">6</value>
</values>
</rule>
<rule id="kern.debug" class="kern" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @kern.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">7</value>
</values>
</rule>
<rule id="user.emerg" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">8</value>
</values>
</rule>
<rule id="user.alert" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">9</value>
</values>
</rule>
<rule id="user.crit" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">10</value>
</values>
</rule>
<rule id="user.err" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">11</value>
</values>
</rule>
<rule id="user.warning" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">12</value>
</values>
</rule>
<rule id="user.notice" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">13</value>
</values>
</rule>
<rule id="user.info" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">14</value>
</values>
</rule>
<rule id="user.debug" class="user" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @user.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">15</value>
</values>
</rule>
<rule id="mail.emerg" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">16</value>
</values>
</rule>
<rule id="mail.alert" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">17</value>
</values>
</rule>
<rule id="mail.crit" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">18</value>
</values>
</rule>
<rule id="mail.err" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">19</value>
</values>
</rule>
<rule id="mail.warning" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">20</value>
</values>
</rule>
<rule id="mail.notice" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">21</value>
</values>
</rule>
<rule id="mail.info" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">22</value>
</values>
</rule>
<rule id="mail.debug" class="mail" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @mail.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">23</value>
</values>
</rule>
<rule id="daemon.emerg" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">24</value>
</values>
</rule>
<rule id="daemon.alert" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">25</value>
</values>
</rule>
<rule id="daemon.crit" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">26</value>
</values>
</rule>
<rule id="daemon.err" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">27</value>
</values>
</rule>
<rule id="daemon.warning" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">28</value>
</values>
</rule>
<rule id="daemon.notice" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">29</value>
</values>
</rule>
<rule id="daemon.info" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">30</value>
</values>
</rule>
<rule id="daemon.debug" class="daemon" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @daemon.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">31</value>
</values>
</rule>
<rule id="auth.emerg" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">32</value>
</values>
</rule>
<rule id="auth.alert" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">33</value>
</values>
</rule>
<rule id="auth.crit" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">34</value>
</values>
</rule>
<rule id="auth.err" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">35</value>
</values>
</rule>
<rule id="auth.warning" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">36</value>
</values>
</rule>
<rule id="auth.notice" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">37</value>
</values>
</rule>
<rule id="auth.info" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">38</value>
</values>
</rule>
<rule id="auth.debug" class="auth" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @auth.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">39</value>
</values>
</rule>
<rule id="syslog.emerg" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">40</value>
</values>
</rule>
<rule id="syslog.alert" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">41</value>
</values>
</rule>
<rule id="syslog.crit" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">42</value>
</values>
</rule>
<rule id="syslog.err" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">43</value>
</values>
</rule>
<rule id="syslog.warning" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">44</value>
</values>
</rule>
<rule id="syslog.notice" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">45</value>
</values>
</rule>
<rule id="syslog.info" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">46</value>
</values>
</rule>
<rule id="syslog.debug" class="syslog" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @syslog.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">47</value>
</values>
</rule>
<rule id="lpr.emerg" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">48</value>
</values>
</rule>
<rule id="lpr.alert" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">49</value>
</values>
</rule>
<rule id="lpr.crit" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">50</value>
</values>
</rule>
<rule id="lpr.err" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">51</value>
</values>
</rule>
<rule id="lpr.warning" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">52</value>
</values>
</rule>
<rule id="lpr.notice" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">53</value>
</values>
</rule>
<rule id="lpr.info" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">54</value>
</values>
</rule>
<rule id="lpr.debug" class="lpr" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @lpr.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">55</value>
</values>
</rule>
<rule id="news.emerg" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">56</value>
</values>
</rule>
<rule id="news.alert" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">57</value>
</values>
</rule>
<rule id="news.crit" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">58</value>
</values>
</rule>
<rule id="news.err" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">59</value>
</values>
</rule>
<rule id="news.warning" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">60</value>
</values>
</rule>
<rule id="news.notice" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">61</value>
</values>
</rule>
<rule id="news.info" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">62</value>
</values>
</rule>
<rule id="news.debug" class="news" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @news.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">63</value>
</values>
</rule>
<rule id="uucp.emerg" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">64</value>
</values>
</rule>
<rule id="uucp.alert" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">65</value>
</values>
</rule>
<rule id="uucp.crit" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">66</value>
</values>
</rule>
<rule id="uucp.err" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">67</value>
</values>
</rule>
<rule id="uucp.warning" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">68</value>
</values>
</rule>
<rule id="uucp.notice" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">69</value>
</values>
</rule>
<rule id="uucp.info" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">70</value>
</values>
</rule>
<rule id="uucp.debug" class="uucp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @uucp.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">71</value>
</values>
</rule>
<rule id="cron.emerg" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">72</value>
</values>
</rule>
<rule id="cron.alert" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">73</value>
</values>
</rule>
<rule id="cron.crit" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">74</value>
</values>
</rule>
<rule id="cron.err" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">75</value>
</values>
</rule>
<rule id="cron.warning" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">76</value>
</values>
</rule>
<rule id="cron.notice" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">77</value>
</values>
</rule>
<rule id="cron.info" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">78</value>
</values>
</rule>
<rule id="cron.debug" class="cron" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @cron.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">79</value>
</values>
</rule>
<rule id="authpriv.emerg" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">80</value>
</values>
</rule>
<rule id="authpriv.alert" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">81</value>
</values>
</rule>
<rule id="authpriv.crit" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">82</value>
</values>
</rule>
<rule id="authpriv.err" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">83</value>
</values>
</rule>
<rule id="authpriv.warning" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">84</value>
</values>
</rule>
<rule id="authpriv.notice" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">85</value>
</values>
</rule>
<rule id="authpriv.info" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">86</value>
</values>
</rule>
<rule id="authpriv.debug" class="authpriv" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @authpriv.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">87</value>
</values>
</rule>
<rule id="ftp.emerg" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">88</value>
</values>
</rule>
<rule id="ftp.alert" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">89</value>
</values>
</rule>
<rule id="ftp.crit" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">90</value>
</values>
</rule>
<rule id="ftp.err" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">91</value>
</values>
</rule>
<rule id="ftp.warning" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">92</value>
</values>
</rule>
<rule id="ftp.notice" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">93</value>
</values>
</rule>
<rule id="ftp.info" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">94</value>
</values>
</rule>
<rule id="ftp.debug" class="ftp" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @ftp.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">95</value>
</values>
</rule>
<rule id="local0.emerg" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">128</value>
</values>
</rule>
<rule id="local0.alert" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">129</value>
</values>
</rule>
<rule id="local0.crit" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">130</value>
</values>
</rule>
<rule id="local0.err" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">131</value>
</values>
</rule>
<rule id="local0.warning" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">132</value>
</values>
</rule>
<rule id="local0.notice" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">133</value>
</values>
</rule>
<rule id="local0.info" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">134</value>
</values>
</rule>
<rule id="local0.debug" class="local0" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local0.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">135</value>
</values>
</rule>
<rule id="local1.emerg" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">136</value>
</values>
</rule>
<rule id="local1.alert" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">137</value>
</values>
</rule>
<rule id="local1.crit" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">138</value>
</values>
</rule>
<rule id="local1.err" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">139</value>
</values>
</rule>
<rule id="local1.warning" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">140</value>
</values>
</rule>
<rule id="local1.notice" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">141</value>
</values>
</rule>
<rule id="local1.info" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">142</value>
</values>
</rule>
<rule id="local1.debug" class="local1" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local1.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">143</value>
</values>
</rule>
<rule id="local2.emerg" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">144</value>
</values>
</rule>
<rule id="local2.alert" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">145</value>
</values>
</rule>
<rule id="local2.crit" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">146</value>
</values>
</rule>
<rule id="local2.err" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">147</value>
</values>
</rule>
<rule id="local2.warning" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">148</value>
</values>
</rule>
<rule id="local2.notice" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">149</value>
</values>
</rule>
<rule id="local2.info" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">150</value>
</values>
</rule>
<rule id="local2.debug" class="local2" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local2.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">151</value>
</values>
</rule>
<rule id="local3.emerg" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">152</value>
</values>
</rule>
<rule id="local3.alert" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">153</value>
</values>
</rule>
<rule id="local3.crit" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">154</value>
</values>
</rule>
<rule id="local3.err" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">155</value>
</values>
</rule>
<rule id="local3.warning" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">156</value>
</values>
</rule>
<rule id="local3.notice" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">157</value>
</values>
</rule>
<rule id="local3.info" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">158</value>
</values>
</rule>
<rule id="local3.debug" class="local3" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local3.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">159</value>
</values>
</rule>
<rule id="local4.emerg" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">160</value>
</values>
</rule>
<rule id="local4.alert" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">161</value>
</values>
</rule>
<rule id="local4.crit" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">162</value>
</values>
</rule>
<rule id="local4.err" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">163</value>
</values>
</rule>
<rule id="local4.warning" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">164</value>
</values>
</rule>
<rule id="local4.notice" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">165</value>
</values>
</rule>
<rule id="local4.info" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">166</value>
</values>
</rule>
<rule id="local4.debug" class="local4" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local4.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">167</value>
</values>
</rule>
<rule id="local5.emerg" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">168</value>
</values>
</rule>
<rule id="local5.alert" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">169</value>
</values>
</rule>
<rule id="local5.crit" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">170</value>
</values>
</rule>
<rule id="local5.err" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">171</value>
</values>
</rule>
<rule id="local5.warning" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">172</value>
</values>
</rule>
<rule id="local5.notice" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">173</value>
</values>
</rule>
<rule id="local5.info" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">174</value>
</values>
</rule>
<rule id="local5.debug" class="local5" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local5.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">175</value>
</values>
</rule>
<rule id="local6.emerg" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">176</value>
</values>
</rule>
<rule id="local6.alert" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">177</value>
</values>
</rule>
<rule id="local6.crit" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">178</value>
</values>
</rule>
<rule id="local6.err" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">179</value>
</values>
</rule>
<rule id="local6.warning" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">180</value>
</values>
</rule>
<rule id="local6.notice" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">181</value>
</values>
</rule>
<rule id="local6.info" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">182</value>
</values>
</rule>
<rule id="local6.debug" class="local6" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local6.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">183</value>
</values>
</rule>
<rule id="local7.emerg" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.emerg @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">184</value>
</values>
</rule>
<rule id="local7.alert" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.alert @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">185</value>
</values>
</rule>
<rule id="local7.crit" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.crit @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">186</value>
</values>
</rule>
<rule id="local7.err" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.err @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">187</value>
</values>
</rule>
<rule id="local7.warning" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.warning @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">188</value>
</values>
</rule>
<rule id="local7.notice" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.notice @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">189</value>
</values>
</rule>
<rule id="local7.info" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.info @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">190</value>
</values>
</rule>
<rule id="local7.debug" class="local7" provider="noName">
<patterns>
<pattern>@ESTRING:parsedate: @@ESTRING:parsehost: @local7.debug @ANYSTRING:parsemessage@</pattern>
</patterns>
<values>
<value name="pri">191</value>
</values>
</rule>
</rules>
</ruleset>
</patterndb>