CODEWITHSUNDEEP
syslog-ng
user320883
user320883

Reputation: 1

Syslog-ng row message required to send- no timestamp - no header require

I am using below configuration of syslog-ng OS. Our purpose is to get the syslog message from device and relay the same message to analytic tool. We want to have row log message as shown below , to be sent to analytic tool without removing any character (i.e. ',") from original message. providing configuration file , original log and processed log (by syslog-ng). We also want to get rid of additional header or timestamp added by syslog-ng.

Configuration file Used version:- Version: 3.2.5

options {flush_lines (0);time_reopen (10);log_fifo_size (1000);long_hostnames (off);use_dns (no);      use_fqdn (no);create_dirs (no);keep_hostname (yes);keep-timestamp(no);};

source slocal{syslog(port(514) transport("udp")flags(no-parse) );};

template t_syslog {template("${MESSAGE}\n");template-escape(yes);};

destination dfgtall { file("/var/netwitness/fgtall.log" template(t_syslog)); };

log { source(slocal);destination(dfgtall); };

Original log

date=2020-03-07 time=20:46:02 devname="ABCD" devid="FGT" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="VDOM-Int" eventtime=1583594162 srcip=1.1.1.1 srcport=55498 srcintf="LAN" srcintfrole="lan" dstip=10.10.10.1 dstport=21 dstintf="EXTERNAL" dstintfrole="wan" sessionid=583411984 proto=6 action="deny" policyid=0 policytype="policy" service="FTP" dstcountry="United States" srccountry="Reserved" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel="high"

Received log message

<5>Jul 20 14:41:42 root: date=2020-03-07 time=20:46:02 devname=ABCD devid=FGT logid=0000000013 type=traffic subtype=forward level=notice vd=VDOM-Int eventtime=1583594162 srcip=1.1.1.1 srcport=55498 srcintf=LAN srcintfrole=lan dstip=10.10.10.1 dstport=21 dstintf=EXTERNAL dstintfrole=wan sessionid=583411984 proto=6 action=deny policyid=0 policytype=policy service=FTP dstcountry=United States srccountry=Reserved trandisp=noop duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat=unscanned crscore=30 craction=131072 crlevel=high

Upvotes: 0

Views: 1200

Answers (1)

MrAnno
MrAnno

Reputation: 754

syslog-ng v3.2.5 is really old. Please upgrade to a newer version.

Using flags(no-parse) in the source, and the proper template in the destination config ($MESSAGE\n) are the key here.

The following snippet works as expected with syslog-ng v3.28:

source s_udp {
  syslog(
    port(514)
    transport("udp")
    flags(no-parse)
  );
};

destination dfgtall { file("/tmp/fgtall.log" template("${MESSAGE}\n")); };

log {
  source(s_udp);
  destination(dfgtall);
};

Upvotes: 1

Related Questions