Link to home
Start Free TrialLog in
Avatar of Julio Jose
Julio JoseFlag for Malaysia

asked on

rsyslog raw message

I have configure to receive the raw format on rsyslog.conf

$template myFormat,"%rawmsg%\n"
$ActionFileDefaultTemplate myFormat

but I still received the facility code in append on each of the log, how to get rid of it?

<46>Nov 02 10:37:39 …...
Avatar of skullnobrains
skullnobrains

you need something along these lines

$template nofacility,"%timegenerated% %msg%\n"

not sure what "raw"msg stands for but it is probably the whole message syslog receives including the facility, tag, date...
Avatar of Julio Jose

ASKER

I tired, the facility code remove but append a new time format "Mar 27 11:12:19 <Raw Message>
ASKER CERTIFIED SOLUTION
Avatar of skullnobrains
skullnobrains

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
it work, thank you