Send File by Syslog w/o header | Log collection solutions

#1 _omar_ 6 years ago

Hello

I'm using "NXLog CE" for send a file by syslog. So far I got this:

&lt;Input filezilla&gt;
	Module		im_file
	File		&quot;C:\\Program Files (x86)\\FileZilla Server\\Logs\\fzs-*.log&quot;
	SavePos 	TRUE
	Exec		$Message = '%FileZilla: ' + $raw_event;
&lt;/Input&gt;
&lt;Output outfiles&gt;
    Module      om_tcp
    Host        10.226.6.210
    Port        514
    Exec		to_syslog_bsd();
&lt;/Output&gt;

The file has lines like "(125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT" I want to get (on my syslog sever) "%FileZilla: (125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT" Instead, I got: "Mar 13 12:33:00 DSCRESJ %FileZilla: (125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT"

I think the "Mar 13 12:33:00 DSCRESJ" part is the header from to_syslog_bsd(). Anyway, I wonder If there a way to remove that header.

Regards.

Permalink

#2 b0ti Nxlog ✓ 6 years ago (Last updated 6 years ago )

#1 _omar_

Hello I'm using "NXLog CE" for send a file by syslog. So far I got this: <Input filezilla> Module im_file File "C:\\Program Files (x86)\\FileZilla Server\\Logs\\fzs-*.log" SavePos TRUE Exec $Message = '%FileZilla: ' + $raw_event; </Input> <Output outfiles> Module om_tcp Host 10.226.6.210 Port 514 Exec to_syslog_bsd(); </Output> The file has lines like "(125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT" I want to get (on my syslog sever) "%FileZilla: (125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT" Instead, I got: "Mar 13 12:33:00 DSCRESJ %FileZilla: (125419) 13/03/2018 12:32:59 - prtg (10.4.171.245)> QUIT" I think the "Mar 13 12:33:00 DSCRESJ" part is the header from to_syslog_bsd(). Anyway, I wonder If there a way to remove that header. Regards.

Replace the following:

Exec to_syslog_bsd();

with this:

Exec $raw_event = '%Filezilla ' + $raw_event;