On 03/15/2013 04:50 PM, John P. Rouillard wrote: > > In message<[email protected]>, > Risto Vaarandi writes: >> On 12/15/2012 12:01 AM, mindman101 wrote: >>> Does anyone know how to send an event to syslog-ng under sec rules? >>> >>> I mean, something like: >>> >>> action: send_syslog(facility, level, event) >>> >>> Thanks for your support. >> >> In the 2.7.1 version, one efficient way for this is communicating >> directly with the /dev/log socket. This is useful if you want to issue >> events with different tags (program names), since standard openlog(3) >> and syslog(3) calls do not allow for changing the syslog tag. > > What's the format of the entry that should be sent to /dev/log? >
The BSD syslog messages are normally formatted as: <priority>timestamp hostname tag: message_text (for example, <30>Mar 15 12:11:41 myhost test: this is a test) However, since for logging at the local system the hostname is always the same, linux syslog daemons often expect the events from /dev/log having the format: <priority>timestamp tag: message_text (for example, <30>Mar 15 12:11:41 test: this is a test) The rules and perl code in the example are following this format when writing events to /dev/log. kind regards, risto ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
