1

I have install Syslog-NG with MongoDB and LogAnalyzer, and as the Title saying, im missing Date, Facility and Severity on a front page of the LogAnalyzer ( first page ). I get just Hostname and ProcessID. On the messages i have nothing and when i go into more details on one of the messages/logs i get all the details that are missing on the front page. Also im using TLS and have place the flag in the syslog-ng configuration file: flags(syslog-protocol)

Here are some pictures: enter image description here And the info i have if i go to one of the logs enter image description here

Any hints about it?

Here are some configuration about the syslog-NG server:

options {
    flush_lines (0);
    time_reopen (10);
    log_fifo_size (1000);
    chain_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    create_dirs (no);
    keep_hostname (yes);
};

source s_sys {
        system();
        internal();
        network(ip(0.0.0.0) port(6514)
        flags(syslog-protocol)
        transport("tls")
        tls(key_file("/etc/syslog-ng/cert.d/serverkey.pem")
        cert_file("/etc/syslog-ng/cert.d/servercert.pem")
        ca_dir("/etc/syslog-ng/ca.d")
        ) );

};

destination d_mongodb {
        mongodb(
        servers("localhost:27017")
        database("syslog")
        username("Test")
        password("Test123")
        collection("messages")
        value-pairs(
        scope("selected-macros" "nv-pairs" "sdata")
                )
                        );
                        };

The rest of it is default ( off course the destination "d_mongdb" is used ).

And here is the Client Syslog-NG configuration:

options {
    flush_lines (0);
    time_reopen (10);
    log_fifo_size (1000);
    chain_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    create_dirs (no);
    keep_hostname (yes);
};

source s_sys {
    system();
    internal();
    # udp(ip(0.0.0.0) port(514));
};

destination tls_destination {
    network("x.x.x.x" port(6514)
        flags(syslog-protocol)
    transport("tls")
    tls( ca_dir("/etc/syslog-ng/ca.d")
         key_file("/etc/syslog-ng/cert.d/clientkey.pem")
         cert_file("/etc/syslog-ng/cert.d/clientcert.pem") )
);
     };
  • you should add a bit more information like your syslog server configuration, and your syslog client configuration. that could help – Kiwy May 17 '16 at 12:48
  • Anything about this ? – IvanAK May 18 '16 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.