Home → Suggestions →

Submission: Config for checking syslog-ng (and probably other 'regular') syslog files.

• Edit

walter.brock

12 Jan, 2014 02:28 PM

I have another machine running syslog-ng, which uses the more traditional syslog format when writing to /var/log/messages. So here's is the config for that one. Hope someone finds it useful!

"syslog1": { "display" : "Syslog", "path" : "/var/log/messages", "refresh" : 5, "max" : 50, "notify" : false, "format" : { "regex": "|(.*?) ([0-9]{1,2}) ([0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32})\[(.*?)\]:(.*)|", "match": { "Date" : 3, "Source" : 4, "Tag_ID" : 5, "PID" : 6, "Message" : 7 }, "types": { "Date" : "date:H:i:s", "Source" : "txt", "Tag_ID" : "txt", "PID" : "numeral", "Message" : "txt" } } }

1. Support Staff 1 Posted by potsky on 12 Jan, 2014 07:18 PM

   

   Hi Walter,

   thank you for this contribution!

   Here is the formatted version :

   "syslog1": {
       "display": "Syslog",
       "path": "/var/log/messages",
       "refresh": 5,
       "max": 50,
       "notify": false,
       "format": {
           "regex": "|(.*?) ([0-9]{1,2}) ([0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32})\[(.*?)\]:(.*)|",
           "match": {
               "Date": 3,
               "Source": 4,
               "Tag_ID": 5,
               "PID": 6,
               "Message": 7
           },
           "types": {
               "Date": "date:H:i:s",
               "Source": "txt",
               "Tag_ID": "txt",
               "PID": "numeral",
               "Message": "txt"
           }
       }
   }
   

   Could you provide us a sample of a matched log line please?

   • Edit

2. 2 Posted by walter.brock on 13 Jan, 2014 04:00 PM

   

   Sorry for the delay, I missed the request for the log sample yesterday.

   Please see attached.

   Have A Great Day!

   • syslog_ng_sample.txt 1.13 KB
   • Edit

3. Support Staff 3 Posted by potsky on 15 Jan, 2014 09:39 AM

   

   Thank you Walter!

   • Edit

4. potsky closed this discussion on 15 Jul, 2014 11:13 AM.