[rsyslog-notify] Forum Thread: Re: Removing <PRI> in a forwarded syslog message - (Mode 'reply')

[noreply at adiscon.com]

User: smartdave 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25974#p25974

Message: 
----------
No worries.

Ok so I think I am having one last issue

I have the following config file:
# rsyslog configuration file
 
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see <!-- m --><a class="postlink"
href="http://www.rsyslog.com/doc/troubleshoot.html">http://www.rsyslog.com/doc/troubleshoot.html</a><!--
m -->
 
#### MODULES ####
 
# The imjournal module bellow is now used as a message source instead of
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
#$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability
 
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
 
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
 
 
#### GLOBAL DIRECTIVES ####
 
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog
 
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
 
# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
 
# Include all config files in /etc/rsyslog.d/
#$IncludeConfig /etc/rsyslog.d/*.conf
 
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
#$OmitLocalLogging on
 
# File to store the position in the journal
#$IMJournalStateFile imjournal.state
 
 
set $.meg = exec_template("RSYSLOG_TraditionalFileFormat");
$template myfmt,
"[][][%fromhost-ip%][%timegenerated:::date-unixtimestamp%][] %$.meg%\n"
$template myfmt2,
"[][][%fromhost-ip%][%timegenerated:::date-unixtimestamp%][] %rawmsg%\n"
 
 
*.* @192.168.30.42:514;myfmt
# ### end of the forwarding rule ###
 
*.* /var/log/rsys-message;myfmt


And I have redirected my Firewall to send logs to this server

if I run tcpdump -A -i eth0 port 514 I can see all my syslogs coming in.

However the only messages the upstream kiwi server is seeing is the local
centos logs

Any I dea how I can troubleshoot what's happening to my inbound syslogs?

BTW that format seems to be working and removing the <PRI> field so Thanks
a bunch for that

Dave