MonitorWare Knowledge Base

Hi, I have tried rsyslog today. It is working great while log the Linux machines. But I am facing a serious problems while it log the Netscreen firewall log. It was installed in a Debian Etch.

The log of the netscreen in the /var/log/syslog was not in well format. It cannot know the delimit each record from netscreen.

I would like to know which article can teach me how to set the delimiter. It will be good if there is a example too.

Thank you very much.

Do you have an example of the netscreen format you receive? I need both the raw format as well as what rsyslog parses out of it

Rainer

Thanks for reply.

Actually, problem can be fixed when I set the netscreen from using tcp to udp to export the log.

The previous log is that each record is combined together with a tag. Rsyslog is split it every 2047 char.

That sounds like a bug in Netscreen. They seem not to use the usual terminator (LF). Anyhow, I am glad you found a solution.

Rainer