Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I need to change the facility of the syslog message going out to a remote syslog server. I am using rsyslog in my system.
I am using the following configuration to forward logs to another syslog server:
*.* 16.12.45.59:514
Now I would like to change the facility of all the syslog messages which is going to this server as 'user'.
Is it possible to do this?
I am referring the property replacer document . However I am not sure whether I can do that. Please provide some examples too.
No,it is not possible to change the facility/severity of log messages.
The property replacer document is for regex operations on the log message and not the facility/severity.
The rsyslog sends the packet with its header and log message.The log message can be manipulated with Regex but the header contains the facility and severity which is handled by rsyslog/syslog.
You can pass the facility/severity through log message to remote syslog server,but the syslog server would take facility/severity from header of the packet.
