Re: Syslog server chaining issue
Balazs Scheidler <[email protected]> Thu, 12 Dec 2024 09:02:27 +0100
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <CAKcfE+bRSqimYY3xQgGd81scSPcELc22QpZ+SrBqyVkTPw_rdA@mail.gmail.com> |
--===============6791848858524401411== Content-Type: multipart/alternative; boundary="000000000000609c8c06290e23b6" --000000000000609c8c06290e23b6 Content-Type: text/plain; charset="UTF-8" If you supply the template() option on the first server, that change the format the protocol expects. So you need to use the standard template and then reformat it to your needs on the 2nd, by using template there. The reason the $program captured the severity value as you were using $SEVERITY in the position where the normal syslog format expects the program name. The syslog-ng() driver Fabien mentioned requires you to include scl.conf which is the syslog-ng configuration library. On Thu, Dec 12, 2024, 07:43 Maurya, Shivani <[email protected]> wrote: > Thanks for the response. > > The format mentioned in the admin guide for 1st syslog server is resulting > in failure of syslog-ng service, hence I modified it to make sure the > syslog-ng service starts. > On the 1st syslog server, I added the syslog destination as - > > destination d_ewmm { > syslog("secondary_IP"); > }; > > On 2nd syslog server, default-network-drivers(); option is not working. > Hence, I am trying to capture the syslog messages like - > > source src { > network(transport(udp) ip(secondary_IP) port(514)); > > }; > > But the issue still persists, no change in the message format. > > Regards, > Shivani Maurya > > -----Original Message----- > From: syslog-ng <[email protected]> On Behalf Of Fabien > Wernli > Sent: Wednesday, December 11, 2024 8:10 PM > To: Syslog-ng users' and developers' mailing list < > [email protected]> > Subject: Re: [syslog-ng] Syslog server chaining issue > > Hi, > > On 2024-12-11 12:47:29, Maurya, Shivani wrote: > > Hi All, > > > > I am using 2 syslog servers on version 3.31. The devices are sending > syslog message to 1st syslog server. The 1st syslog server is forwarding > the same message to 2nd syslog server. > > > > Device --> Syslog Server 1 --> Syslog Server 2 > > I would suggest that you use the syslog-ng() destination so you don't have > to worry about your udp template being reinterpreted poorly by the second > syslog-ng. > > > https://syslog-ng.github.io/admin-guide/020_The_concepts_of_syslog-ng/007_The_structure_of_a_log_message/002_EWMM_messages > > https://syslog-ng.github.io/admin-guide/070_Destinations/310_syslog-ng/README > > https://syslog-ng.github.io/admin-guide/060_Sources/000_Default-network-drivers/README > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > --000000000000609c8c06290e23b6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">If you supply the template() option on the first server, = that change the format the protocol expects. So you need to use the standar= d template and then reformat it to your needs on the 2nd, by using template= there.<div dir=3D"auto"><br></div><div dir=3D"auto">The reason the $progra= m captured the severity value as you were using $SEVERITY in the position w= here the normal syslog format expects the program name.</div><div dir=3D"au= to"><br></div><div dir=3D"auto">The syslog-ng() driver Fabien mentioned req= uires you to include scl.conf which is the syslog-ng configuration library.= </div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_= attr">On Thu, Dec 12, 2024, 07:43 Maurya, Shivani <<a href=3D"mailto:shi= [email protected]">[email protected]</a>> wrote:<br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #= ccc solid;padding-left:1ex">Thanks for the response. <br> <br> The format mentioned in the admin guide for 1st syslog server is resulting = in failure of syslog-ng service, hence I modified it to make sure the syslo= g-ng service starts. <br> On the 1st syslog server, I added the syslog destination as -<br> <br> destination d_ewmm {<br> =C2=A0 =C2=A0 syslog("secondary_IP");<br> };<br> <br> On 2nd syslog server, default-network-drivers(); option is not working. Hen= ce, I am trying to capture the syslog messages like - <br> <br> source src {<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 network(transport(udp) ip(secondary_IP) port(51= 4));<br> <br> };<br> <br> But the issue still persists, no change in the message format. <br> <br> Regards,<br> Shivani Maurya<br> <br> -----Original Message-----<br> From: syslog-ng <<a href=3D"mailto:[email protected]" t= arget=3D"_blank" rel=3D"noreferrer">[email protected]</a>&= gt; On Behalf Of Fabien Wernli<br> Sent: Wednesday, December 11, 2024 8:10 PM<br> To: Syslog-ng users' and developers' mailing list <<a href=3D"ma= ilto:[email protected]" target=3D"_blank" rel=3D"noreferrer">syslo= [email protected]</a>><br> Subject: Re: [syslog-ng] Syslog server chaining issue<br> <br> Hi,<br> <br> On 2024-12-11 12:47:29, Maurya, Shivani wrote:<br> > Hi All,<br> > <br> > I am using 2 syslog servers on version 3.31. The devices are sending s= yslog message to 1st syslog server. The 1st syslog server is forwarding the= same message to 2nd syslog server.<br> > <br> > Device --> Syslog Server 1 --> Syslog Server 2<br> <br> I would suggest that you use the syslog-ng() destination so you don't h= ave to worry about your udp template being reinterpreted poorly by the seco= nd syslog-ng.<br> <br> <a href=3D"https://syslog-ng.github.io/admin-guide/020_The_concepts_of_sysl= og-ng/007_The_structure_of_a_log_message/002_EWMM_messages" rel=3D"noreferr= er noreferrer" target=3D"_blank">https://syslog-ng.github.io/admin-guide/02= 0_The_concepts_of_syslog-ng/007_The_structure_of_a_log_message/002_EWMM_mes= sages</a><br> <a href=3D"https://syslog-ng.github.io/admin-guide/070_Destinations/310_sys= log-ng/README" rel=3D"noreferrer noreferrer" target=3D"_blank">https://sysl= og-ng.github.io/admin-guide/070_Destinations/310_syslog-ng/README</a><br> <a href=3D"https://syslog-ng.github.io/admin-guide/060_Sources/000_Default-= network-drivers/README" rel=3D"noreferrer noreferrer" target=3D"_blank">htt= ps://syslog-ng.github.io/admin-guide/060_Sources/000_Default-network-driver= s/README</a><br> <br> ___________________________________________________________________________= ___<br> Member info: <a href=3D"https://lists.balabit.hu/mailman/listinfo/syslog-ng= " rel=3D"noreferrer noreferrer" target=3D"_blank">https://lists.balabit.hu/= mailman/listinfo/syslog-ng</a><br> Documentation: <a href=3D"http://www.balabit.com/support/documentation/?pro= duct=3Dsyslog-ng" rel=3D"noreferrer noreferrer" target=3D"_blank">http://ww= w.balabit.com/support/documentation/?product=3Dsyslog-ng</a><br> FAQ: <a href=3D"http://www.balabit.com/wiki/syslog-ng-faq" rel=3D"noreferre= r noreferrer" target=3D"_blank">http://www.balabit.com/wiki/syslog-ng-faq</= a><br> <br> ___________________________________________________________________________= ___<br> Member info: <a href=3D"https://lists.balabit.hu/mailman/listinfo/syslog-ng= " rel=3D"noreferrer noreferrer" target=3D"_blank">https://lists.balabit.hu/= mailman/listinfo/syslog-ng</a><br> Documentation: <a href=3D"http://www.balabit.com/support/documentation/?pro= duct=3Dsyslog-ng" rel=3D"noreferrer noreferrer" target=3D"_blank">http://ww= w.balabit.com/support/documentation/?product=3Dsyslog-ng</a><br> FAQ: <a href=3D"http://www.balabit.com/wiki/syslog-ng-faq" rel=3D"noreferre= r noreferrer" target=3D"_blank">http://www.balabit.com/wiki/syslog-ng-faq</= a><br> <br> </blockquote></div> --000000000000609c8c06290e23b6-- --===============6791848858524401411== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============6791848858524401411==--