Forum Discussion
geffryti_32102
Jun 14, 2011Nimbostratus
Yup, that fixed it. Below is the working config.
b syslog include '" local3.* /var/log/asm
filter f_local3a {
facility(local3);
};
template t_asm {
template(\"<190> $DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
destination d_asmtest {
file(\"/var/log/lost+found/output/testasmlog\" template(t_asm));
};
destination d_loghost5a {
udp(\"10.2.2.2\" port (514));
};
log {
source(local);
filter(f_local3a);
destination(d_asmtest);
destination(d_loghost5a);
};
"'
But below is the end result of the syslog... as you can see it actually wrote <190> instead of changing the facility. I'll play around with it and get back to you if I fix it...
<190> Jun 14 06:51:51 blah blah blah blah blah