Return
-
Title
How to configure BSD-syslog and IETF-syslog message formats in Syslog-ng Store Box -
Description
How to configure BSD-syslog (RFC 3164) and IETF-syslog (RFC 5424) message formats in Syslog-ng Store Box (SSB). -
Resolution
Configuring BSD-syslog (RFC 3164) format
Source configuration
- Check the following documentation to create a new source, Creating syslog message sources in SSB.
- As described in step 5, select "Legacy" as syslog protocol
Destination configuration
- Check the following documentation to create a new destination, Forwarding log messages to remote servers
- As described in step 5, select "Legacy" as syslog protocol
Configuring IETF-syslog (RFC 5424) format
Source configuration
- Check the following documentation to create a new source, Creating syslog message sources in SSB.
- As described in step 5, select "Syslog" as syslog protocol
Destination configuration
- Check the following documentation to create a new destination, Forwarding log messages to remote servers
- As described in step 5, select "Syslog" as syslog protocol
Disable message parsing on sources
If the messages arriving to the source do not comply to the standard syslog message format for some reason, select the Syslog flags > Do not parse messages option. This option completely disables syslog message parsing and treats the complete log line as the MESSAGE part of a syslog message. Other information (timestamp, host, and so on) is added automatically by SSB.
If syslog and non-syslog messages arrive to the same SSB source, it is recommended to create a separate source for both message types.
For non-syslog messages select "Do not parse" option on the source.
-
Additional Information