Forum Discussion

Pierrot_72229's avatar
Pierrot_72229
Icon for Nimbostratus rankNimbostratus
Dec 14, 2011

Template format of syslog event

Hi all,

 

 

I'm lookin to change the template of syslog event.

 

Currently, we have :

 

template t_commontmpl {

 

template("<$PRI> $DATE local/$HOST $PRIORITY $MSG\n");

 

template_escape(no);

 

};

 

 

 

I want to do this :

 

template("<$PRI> $DATE F5_Networks local/$HOST $PRIORITY $MSG\n");

 

 

 

Problem is that syslog-ng.conf could not be change (read-only mode) and it not works to put this configuration with command b syslog include..

 

 

 

Do you think there a solution for this request please ?

 

 

 

Thanks all :)

 

 

 

Pierrot

 

management
monitoring

3 Replies

Sort By
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 15, 2011
    You mean the file is read-only? It's not supported to edit the file (And will probably be over-written since it lives in /var/run/config/), but if you use vi to do the edit, then to write it use ':w!' instead of a plain ':w' and the write will be forced even if the file is RO. (Or you can set the permissions of the file using chmod).

     

     

    H
  • jsgibbs1's avatar
    jsgibbs1
    Icon for Nimbostratus rankNimbostratus
    Mar 23, 2016

    Several years after the original post and I'm faced with a similar issue, but on 11.6 HF5. I need to modify the template to include the internalID statement below?

    Original:

        template t_commontmpl {  
            template("<$PRI> $DATE local/$HOST $PRIORITY $MSG\n");
            template_escape(no);
    };

    New:

        template t_commontmpl {  
            template("<$PRI> $DATE local/$HOST $PRIORITY $MSG\n");
            template_escape(no);
            internalID:xxxxxxxxxxxxxx\n";
    };

    Does anyone know how to make this change using tmsh, since that is the suggesed way to do this according to the warning at the top of the file when attempting to vi /etc/syslog-ng/syslog-ng.conf directly?