being on Ubuntu 16.04.5 LTS with rsyslogd.

We have the following situation:

(1) An appliance forwards syslog to the Ubuntu host. (2) Ubuntu Host stores those forwarded messages in a separate logfile (3) Ubuntu Host also forwards this to a 3rd machine

Details how configuration currently looks like

(1) In /etc/rsyslog.conf, follwing has been enabled:

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

(2) Has been achieved by creating 30-remotehosts.conf in /etc/rsyslog.d with following content:

:fromhost-ip, isequal, "<sending_IP>" /var/log/remotesyslog/<name>.log
& ~

(3) has been achieved by way of creating 10-send_to_other_hosts.conf in /etc/rsyslog.d with following content:

:fromhost-ip, isequal, "<sending_IP>"   @<destination_IP>:514

So far so good, works as expected.

However, what we would need now is to alter the logline before sending to the destination.

One example log line currently is

Dec  7 11:10:07 srvde450.rce-group.local [S=582442040] [SID=9642c9:20:3850677]  1 RTP packets lost: CID=217 [Code:0x600b] [CID:217] [Time:07-12@10:10:13]

We would neet it to be changed to the following before sending to the destination:

[S=582442040] [SID=9642c9:20:3850677]  1 RTP packets lost: CID=217 [Code:0x600b] [CID:217] [Time:07-12@10:10:13]

So remove timestamp and source.

How could that be achieved?

You should be able to do this by specifying a template for the data which would just have the msg field. Note, however, that the remote server may not parse the resulting non-standard line, so it may not be able to handle it using a default setup.

Create a template with, for example,

$template myedit,"%msg%\n"

and use it in your filter line:

:fromhost-ip, isequal, "<sending_IP>"   @<destination_IP>:514;myedit

There are lots of properties like msg that are extracted from the input, and you can manipulate them, for example taking a substring %msg:10:$:% (from char 10 to the end).

  • That looks better, but for whatever reason it strips too much I fear. Original line: Dec 10 08:59:27 <source> [S=595022616] [SID=9642c9:20:3976561] ( sip_stack)( 520076) New SIPMessage created - (#1722) [Time:10-12@07:59:30] Stripped line 12/10 08:59:21.158 <source> local7.info [SID=9642c9:20:3976561] ( sip_stack)( 519149) New SIPMessage created - (#2768) [Time:10-12@07:59:23]\n It looks as if at least the tool is missing [S=595022616] for proper interpreting. What %-thing would that be in the template? – bezibaerchen Dec 10 at 8:01
  • OKay, found %rawmsg% Unfortunately still not doing the trick – bezibaerchen Dec 10 at 8:05
  • Are you looking at these results on the 3rd machine? Is it running rsyslog too? You can do lots of manipulation of the message that is sent, and there are many properties that are parsed out of the original input. I added a line to my answer with 2 links for these. – meuh Dec 10 at 8:23
  • It's the syslog viewer from the vendor. I think I found the difference which makes it fail. I will upload snips of differences, maybe you can help, which would be great. Issue is that the SBC can only forward to one syslog server but we'd like to keep the data longterm. – bezibaerchen Dec 10 at 8:38
  • This is the forwarded message from rsyslogd: img.picshare.at/1544431442_forwarded.jpg That's the original format: img.picshare.at/1544431442_original.jpg I think it needs the linebreaks to interpret SIP messages properly but I can't get my head around how to achieve that. – bezibaerchen Dec 10 at 8:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.