Hi, i'm trying syslog-ng to get ip address from dhcp log
so i need to have the frameipaddress field to be empty in order to replace it from dhcp log so in syslog-ng.conf, i put : source dhcp { tcp(ip(0.0.0.0) port(514)); }; # log { source(dhcp); destination(acct_radius); }; destination acct_radius { pipe("/var/log/mysql.pipe" \ template("UPDATE radacct SET FramedIPAddress = SUBSTRING_INDEX(SUBSTRING_INDEX('$MSG','on ',-1),' to',1) \ WHERE TIMESTAMPDIFF(SECOND,AcctStartTime,CONCAT('$YEAR-$MONTH-$DAY',' ','$HOUR:$MIN:$SEC')) <= 180 AND \ REPLACE(REPLACE(CallingStationId,'-',''),':','') = *REPLACE(SUBSTRING(SUBSTRING_INDEX('$MSG','to ',-1),1,17),':','') \ AND FramedIPAddress = \"\" ;\n*") template-escape(yes)); }; but my FramedIPAddress field still got this strange ip adress 3.118.236.192 somebody has a clue? thanks
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html