[RESOLVED] Syslog Bug

[zekicker]

Hello,

I think I found a bug with the process of sending log to a remote server.

Filter logs are sent like this :
Jun  2 19:14:18 filterlog: 86,16777216,,1491408988,em0,match,pass,in,4,0x0,,125,30221,0,DF,6,tcp,52,<ipsrc>,<ipdst>,51403,443,0,S,320298021,,65535,,mss;nop;wscale;nop;nop;sackOK

The hostname is missing between the date and the word "filterlog".
I did a capture on the pfsense and the logs are sent like this for filterlog. No problem with nginx logs.

I m using the last 2.3.4 version.
Regards,</ipdst></ipsrc>

[jimp]

Not a bug. syslogd on FreeBSD does not send the hostname. The remote log server usually adds the hostname itself based on the source of the log entries.

You could maybe setup the syslog-ng package if it's more to your liking.

[zekicker]

OK but why is there a difference with a nginx log ?

Jun  2 13:28:30 <hostname></hostname><fqdn>nginx: <ip>- - [02/Jun/2017:13:28:30 +0200] "GET /status_logs_filter_dynamic.php?&logfile=/var/log/filter.log&nentries=50&lastsawtime=1496402757 HTTP/1.1" 200 31 "https://<ip>/status_logs_filter_dynamic.php?logfile=filter&view=dynamic" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/5CLOG</ip></ip></fqdn>

[kpa]

Nginx as far as I know writes its logs directly using its own log formatting that has nothing to do with syslog(3).

[zekicker]

Hello,

Thanks for your answer.

Regards,