The syslog-ng Administrator Guide

The format of the messages received from the eventlog can be customized using macros. Besides the macros, you can use the following characters: <>,():;-+/_, and all alphanumeric characters.

The syslog-ng agent can send the syslog messages using either the ISO or the BSD timestamp format. It is recommended to use the ISO format, because it contains much more information than the BSD format.

The macros related to the date of the message (e.g.: ISODATE, HOUR, etc.) have two further versions each: one with the S_ and one with the R_ prefix (e.g.: S_DATE and R_DATE ). The S_DATE macro represents the date found in the log message, i.e. when the message was sent by the original application. R_DATE is the date when syslog has received the message.

Note that in the syslog-ng agent, the macros without prefix (e.g., DATE) always refer to the receiving date of the message (e.g., R_DATE) when it arrived into the event log container, and are included only for compatibility reasons.

	Warning
	If a remote host is logging into the event log of the local host that is running syslog-ng Agent for Windows, both hosts should be in the same timezone, because the event log message does not include the timezone information of the sender host. Otherwise, the date of the messages received from the remote host will be incorrect.

The following table lists the available macros:

By default, syslog-ng Agent uses the following format: <${PRI}>$DATE $HOST: ${USERNAME}: ${EVENT_NAME} ${EVENT_SOURCE}: [${EVENT_TYPE}] ${MSG} (EventID ${EVENT_ID}) .