Dotaz: syslog-ng upravuje log na log serveru

[Well.p]

posilam z webserveru skrze socket logy apache na sitovy syslog-ng server.

poslani i prijem logu funguje. Bohuzel se neprenese log 1:1, ale jsou pridany dalsi tagy.

<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:10 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 291
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:12 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 286
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:14 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 283
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:16 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 274
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:18 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 282
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:20 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 298
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:22 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 305
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:24 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 285
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:26 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 286
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:28 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 282
<13>Sep  9 13:53:17 apache: web01.tld 192.168.10.1 - - [09/Sep/2015:13:57:30 +0200] "HEAD /check.txt HTTP/1.0" 200 - "-" "-" 287

Přesně : Sep 9 13:53:17 apache: mi zde prekazi, pro dalsi zpracovani logu, to ze se mi log prenasi bez spravnych radku nalepeny za sebe mi pro ted netrapi.

ve virtualhostu:

LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" syslogformat
CustomLog "|/usr/bin/logger -t 'apache'  -u /var/log/apache_log.socket" syslogformat

syslog-ng client

    options {
	flush_lines(0);
	time_reopen(5);
	log_fifo_size(1000);
	long_hostnames(off);
	use_dns(no);
	use_fqdn(no);
	create_dirs(yes);
	keep_hostname(yes);
	chain_hostnames(no);
    };


source s_apache {
    unix-stream("/var/log/apache_log.socket");
};

template t_send_syslog_template {
	template("$MSGHDR$MSG\n"); template_escape(no); 
};


destination d_loggly {
    udp("192.168.10.250" port(5140) template(t_send_syslog_template));
};

log {
    source(s_apache); 
    destination(d_loggly);
};

syslog-ng server

options {
	flush_lines(0);
	time_reopen(5);
	log_fifo_size(1000);
	long_hostnames(off);
	use_dns(no);
	use_fqdn(no);
	create_dirs(yes);
	keep_hostname(yes);
	chain_hostnames(no);
    };

    source s_syslog_in {
	udp(ip(0.0.0.0) port(5140) flags("no-multi-line","no-parse"));
    };

    template t_log_template {
	template("$MSG\n");
	template_escape(no);
    };

    destination d_syslog_file { 
	file("/var/log/apache2/log_-$YEAR-$MONTH-$DAY.log" template(t_log_template));
    };

    log { source(s_syslog_in); destination(d_syslog_file); };

nemá nekdo podobnou zkusenost a nevedel by jak to resit ?

Odpovědi

[NN]

Odstran ten tag(-t 'apache').

[Well.p]

děkuji, bohuzel situace je stejna, jen v logu misto apache je root.

[Well.p]

syslog-ng doplnuje nechtena data dle manualu https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#concepts-server-mode

jako PRI a HEADER. jiny zpusob nez je pres regulerni vyraz smaznout po prijeti me nenapadl. ale ciste reseni si myslim ze to neni.

[alkoholik]

flags(no-parse) a template("$MSG\n")?

[Well.p]

Ani pri uprave:

    options {
	flush_lines(0);
	time_reopen(5);
	log_fifo_size(1000);
	long_hostnames(off);
	use_dns(no);
	use_fqdn(no);
	create_dirs(yes);
	keep_hostname(yes);
	chain_hostnames(no);
    };


source s_apache {
    unix-stream("/var/log/apache_log.socket"  flags(no-parse)) ;
};



destination d_loggly {
    udp("192.168.10.250" port(5140) template("$MGS\n"));
};

log {
    source(s_apache); 
    destination(d_loggly);
};

porad jsou pridavany prebytecne informace.

[NN]

Viz zde to tam podle meho nazoru cpe ten logger. K cemu tam vlastne je? Pokud jsem to pochopil klient si vyzvedava udaje ze souboru:

unix-stream("/var/log/apache_log.socket");

Neslo by ten CustomLog definovat primo?

CustomLog /var/log/apache_log.socket syslogformat

[wall.i]

napad nemáš špatný, ale tohle nejde.