Avatar of Julio Jose
Julio Jose
Flag for Malaysia asked on

rsyslog raw message

I have configure to receive the raw format on rsyslog.conf

$template myFormat,"%rawmsg%\n"
$ActionFileDefaultTemplate myFormat

but I still received the facility code in append on each of the log, how to get rid of it?

<46>Nov 02 10:37:39 …...
LinuxLinux Distributions

Avatar of undefined
Last Comment
Julio Jose

8/22/2022 - Mon
skullnobrains

you need something along these lines

$template nofacility,"%timegenerated% %msg%\n"

not sure what "raw"msg stands for but it is probably the whole message syslog receives including the facility, tag, date...
Julio Jose

ASKER
I tired, the facility code remove but append a new time format "Mar 27 11:12:19 <Raw Message>
ASKER CERTIFIED SOLUTION
skullnobrains

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Julio Jose

ASKER
it work, thank you
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy