On Mon, 20 May 2019, moan22 via rsyslog wrote:
I have following as a template to be used by the remote server:
*$template tpl1,"%timegenerated:::date-rfc3339% %HOSTNAME% %msg%\n"
$ActionFileDefaultTemplate tpl1*
This is actually not a valid syslog message over the wire, you need to include
<%PRI%> at the beginning to be a valid message.
When i look at my own machine's syslog, the logs use this format perfectly.
The targeted remote server does show messages received in the log but they
don't show them using the template i send them in. I do the following on
client side:
*1xx.xx.xx.xxx:514;tpl1*
Am i doing something wrong or is there something i need to do on the server
side as well.
what is it that you are looking at that is making you think that this is
incorrect?
on the receiving machine, log using the template RSYSLOG_DebugFormat and it will
show you exactly what was received over the wire (rawmsg) and all the variables
that were created as a result of parsing the message.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
