0

I have created a syslog server and client. I want to set client serial number in SOURCE macro in all logs being sent to server so that on server side I can retrieve the macro and can create the log file based on client serial number. Following is my rewrite rule:

rewrite set_host{
    set("DEVICE_SERIAL_NO", value("SOURCE"));

};

log { source(s_src); rewrite(set_host); destination(d_net); };

On server side I have written following configuration for log file:

destination d_host-specific {
    file("/var/log/testlogs/$SOURCE/$YEAR/$MONTH/$HOST-$YEAR-$MONTH-$DAY.log");

};

But on server side I get value of $SOURCE as s_net. Seems like SOURCE macro is over-written on server side. How to sustain a macro from client to server and use it on server side?

Darshan Prajapati
  • 103
  • 4

1 Answers1

1

$SOURCE is a local value, it is not forwarded to the server by default. Every destination has an on-wire format, for example, the network() source/destination uses the BSD (RFC 3164) or IETF (RFC 5424) syslog protocol. The default template of these protocols contains $PROGRAM, $MSG, $HOST, $ISODATE, etc., but $SOURCE is not a standard field.

You have multiple options:

  1. You can specify a destination template() manually and then parse the message on the server side. This can be done, for example, in JSON format ($(format-json) and json-parser()).

  2. You can use the structured-data section of a RFC 5424 syslog message:

# client

rewrite set_host {
  set("DEVICE_SERIAL_NO", value(".SDATA.example@32473.SOURCE"));
};

destination d_net {
  syslog("server.address");
};

# server

source s_net {
  syslog();
};

destination d_host_specific {
  file("/var/log/testlogs/${.SDATA.example@32473.SOURCE}/$YEAR/$MONTH/$HOST-$YEAR-$MONTH-$DAY.log");
};

The syslog() and the network(flags(syslog-protocol)) destinations forward messages using the IETF syslog protocol. All subkeys under .SDATA will be serialized automatically into the forwarded message.

  1. syslog-ng >= v3.17 has a dedicated source/destination plugin that transfers messages "in whole" between syslog-ng instances (containing all name-value pairs) in a special format. Both the source and destination objects are called ewmm() (enterprise wide message model).

  2. As an alternative, you can use $HOST with (keep-hostname(yes) on the server side), which is part of the message header.

MrAnno
  • 210
  • 1
  • 7