Forum Discussion

Wouter_de_Bruin's avatar
Wouter_de_Bruin
Icon for Nimbostratus rankNimbostratus
Jul 09, 2008

Can I change default syslog facilities? (9.4.3)

Hello,   is there a way to change the default syslog facilities?   We have an external syslog server (Not managed by us, of course;-) which only forwards facilty 7 messages to the log files ...
management
monitoring
geffryti_32102's avatar
geffryti_32102
Icon for Nimbostratus rankNimbostratus
Jun 14, 2011
Yup, that fixed it. Below is the working config. 

b syslog include '"                        local3.*                                      /var/log/asm
filter f_local3a {
   facility(local3);
};

template t_asm {
   template(\"<190> $DATE $HOST $MSGHDR$MSG\n\");
   template_escape(no);
};

destination d_asmtest {
   file(\"/var/log/lost+found/output/testasmlog\" template(t_asm));
};

destination d_loghost5a {
udp(\"10.2.2.2\" port (514));
};

log {
   source(local);
   filter(f_local3a);
   destination(d_asmtest);
   destination(d_loghost5a);
};
"'

But below is the end result of the syslog... as you can see it actually wrote <190> instead of changing the facility. I'll play around with it and get back to you if I fix it... 

<190> Jun 14 06:51:51 blah blah blah blah blah