[rsyslog] Getting Facility from Synlog-NG

[Rainer Gerhards]

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Dirk H. Schulz
> Sent: Thursday, October 08, 2009 5:59 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Getting Facility from Synlog-NG
> 
> Rainer Gerhards schrieb:
> >> -----Original Message-----
> >> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> >> bounces at lists.adiscon.com] On Behalf Of Dirk H. Schulz
> >> Sent: Wednesday, October 07, 2009 4:32 PM
> >> To: rsyslog at lists.adiscon.com
> >> Subject: [rsyslog] Getting Facility from Synlog-NG
> >>
> >> Hi folks,
> >>
> >> I am not sure if this is the right list to ask, but I hope that
> there
> >> is
> >> more of the related knowledge here.
> >>
> >> I have several Syslog-NG servers reporting to Rsyslog central
> servers
> >> (just because nobody could tell me how to run Rsyslog on NetBSD
> ...).
> >> Now I fould that the facility is not transferred to/evaluated on the
> >> Rsyslog servers; e.g. mail messages are written to syslog instead of
> >> maillog on the Rsyslog machines.
> >>
> >
> > This is strange. Facility is a fairly standard field. Could you tell
> me the
> > content of %rawmwg%. This is done along these lines (if it does not
> work,
> > check doc for exact syntax):
> >
> > $template raw,"%rawmsg%\n"
> > *.* /path/to/file;raw
> >
> 
> I did not find these terms, neither in rsyslog.conf on the central
> logserver servers nor in syslog-ng.conf on the log client servers.
> Rsyslog is 3.18.6-4 on Debian 5.

Well, these are the config statements for the central rsyslog instance...

Rainer