rsyslog raw message

Julio Jose
Julio Jose used Ask the Experts™
on
I have configure to receive the raw format on rsyslog.conf

$template myFormat,"%rawmsg%\n"
$ActionFileDefaultTemplate myFormat

but I still received the facility code in append on each of the log, how to get rid of it?

<46>Nov 02 10:37:39 …...
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solution Only
skullnobrains

Commented:
you need something along these lines

$template nofacility,"%timegenerated% %msg%\n"

not sure what "raw"msg stands for but it is probably the whole message syslog receives including the facility, tag, date...
Julio Jose

Author

Commented:
I tired, the facility code remove but append a new time format "Mar 27 11:12:19 <Raw Message>
Commented:
i included the %timegenerated% in the example template i gave you.
try this

$template nofacility,"%msg%\n"

Open in new window


if you need something different, please make it explicit.
i do not understand your last post.
Julio Jose

Author

Commented:
it work, thank you

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial