The following macros are available in syslog-ng OSE.
Typically used together with the ${HOUR12} macro, ${AMPM} returns the period of the day: AM for hours before mid day and PM for hours after mid day. In reference to a 24-hour clock format, AM is between 00:00-12:00 and PM is between 12:00-24:00. 12AM is midnight. Available in syslog-ng OSE 3.4 and later.
Facility/priority information in the format used by the FreeBSD syslogd: a priority number followed by a letter that indicates the facility. The priority number can range from 0 to 7. The facility letter can range from A to Y, where A corresponds to facility number zero (LOG_KERN), B corresponds to facility 1 (LOG_USER), and so on.
CSV parsers and pattern databases can also define macros from the content of the messages, for example, a pattern database rule can extract the username from a login message and create a macro that references the username. For details on using custom macros created with CSV parsers and pattern databases, see Chapter 12, Parsing and segmenting structured messages and Section 13.2.1, Using parser results in filters and templates, respectively.
Date of the message using the BSD-syslog style timestamp format (month/day/hour/minute/second, each expressed in two digits). This is the original syslog time stamp without year information, for example: Jun 13 15:58:00.
A nonstandard format for the date of the message using the same format as ${DATE}, but including the year as well, for example: 2006 Jun 13 15:58:00.
The full FQDN of the host name chain (without trimming chained hosts), including the domain name.
FQDN of the host that sent the message to syslog-ng as resolved by syslog-ng using DNS. If the message traverses several hosts, this is the last host in the chain.
The syslog-ng OSE application uses the following procedure to determine the value of the $FULLHOST_FROM macro:
The syslog-ng OSE application takes the IP address of the host sending the message.
If the
use_dns()option is enabled, syslog-ng OSE attempts to resolve the IP address to a hostname. If it succeeds, the returned hostname will be the value of the$FULLHOST_FROMmacro. This value will be the FQDN of the host if theuse_fqdn()option is enabled, but only the hostname ifuse_fqdn()is disabled.If the
use_dns()option is disabled, or the address resolution fails, the${FULLHOST_FROM}macro will return the IP address of the sender host.
The hour of day the message was sent in 12-hour clock format. See also the ${AMPM} macro. 12AM is midnight. Available in syslog-ng OSE 3.4 and later.
The name of the source host where the message originates from.
If the message traverses several hosts and the
chain_hostnames()option is on, the first host in the chain is used.If the
keep_hostname()option is disabled (keep_hostname(no)), the value of the $HOST macro will be the DNS hostname of the host that sent the message to syslog-ng OSE (that is, the DNS hostname of the last hop). In this case the $HOST and $HOST_FROM macros will have the same value.If the
keep_hostname()option is enabled (keep_hostname(yes)), the value of the $HOST macro will be the hostname retrieved from the log message. That way the name of the original sender host can be used, even if there are log relays between the sender and the server.
Name of the host that sent the message to syslog-ng, as resolved by syslog-ng using DNS. If the message traverses several hosts, this is the last host in the chain.
Date of the message in the ISO 8601 compatible standard timestamp format (yyyy-mm-ddThh:mm:ss+-ZONE), for example: 2006-06-13T15:58:00.123+01:00. If possible, it is recommended to use ${ISODATE} for timestamping. Note that syslog-ng can produce fractions of a second (for example milliseconds) in the timestamp by using the frac_digits() global or per-destination option.
The priority (also called severity) of the message, represented as a numeric value, for example, 3. For the textual representation of this value, use the ${LEVEL} macro. See Section PRIORITY or LEVEL for details.
The hostname of the computer running syslog-ng OSE — it returns the same result as the hostname command.
The month the message was sent as a decimal value, prefixed with a zero if smaller than 10.
The English abbreviation of the month name (3 letters).
The number of the week in the given month (0-5). The week with numerical value 1 is the first week containing a Monday. The days of month before the first Monday are considered week 0. For example, if a 31-day month begins on a Sunday, then the 1st of the month is week 0, and the end of the month (the 30th and 31st) is week 5.
The millisecond the message was sent.
Available in syslog-ng OSE version 3.4 and later.
Text contents of the log message without the program name and pid. Note that this has changed in syslog-ng version 3.0; in earlier versions this macro included the program name and the pid. In syslog-ng 3.0, the ${MSG} macro became equivalent with the ${MSGONLY} macro. The program name and the pid together are available in the ${MSGHDR} macro.
The name and the pid of the program that sent the log message in PROGRAM[PID]: format. Includes a trailing whitespace. Note that the macro returns an empty value if both the program and pid fields of the message are empty.
A string specifying the type of the message in IETF-syslog (RFC5424-formatted) messages. For example, a firewall might use the ${MSGID} "TCPIN" for incoming TCP traffic and the ${MSGID} "TCPOUT" for outgoing TCP traffic. By default, syslog-ng OSE does not specify this value, but uses a dash (-) character instead. If an incoming message includes the ${MSGID} value, it is retained and relayed without modification.
The priority and facility encoded as a 2 or 3 digit decimal number as it is present in syslog messages.
The priority (also called severity) of the message, for example, error. For the textual representation of this value, use the ${LEVEL} macro. See Section PRIORITY or LEVEL for details.
The name of the program sending the message. Note that the content of the ${PROGRAM} variable may not be completely trusted as it is provided by the client program that constructed the message.
The syslog-ng application automatically parses the STRUCTURED-DATA part of IETF-syslog messages, which can be referenced in macros. The ${SDATA} macro references the entire STRUCTURED-DATA part of the message, while structured data elements can be referenced using the ${.SDATA.SDID.SDNAME} macro.
| Note |
|---|
|
When using STRUCTURED-DATA macros, consider the following: |
The sequence number of the message is a unique identifier of the message between the end-points. The syslog-ng client calculates this number when processing a new message from a local source; it is not calculated for relayed messages. The sequence number increases for every message, and is not lost even if syslog-ng is reloaded. The sequence number starts again from 0 when syslog-ng OSE is restarted. The sequence number is a part of every message that uses the new IETF-syslog protocol (${.SDATA.meta.sequenceId}), and can be added to BSD-syslog messages using this macro.
syslog-ng OSE versions 3.4 and later versions store the sequence number from Cisco IOS log messages using the extended timestamp format in this macro. If this message is then forwarded using the IETF-syslog protocol, syslog-ng OSE includes the sequence number received from the Cisco device in the ${.SDATA.meta.sequenceId} part of the message.
| Note |
|---|
|
To enable sequence numbering of log messages on Cisco devices, use the following command on the device (available in IOS 10.0 and later): service sequence-numbers. |
IP address of the host that sent the message to syslog-ng. (That is, the IP address of the host in the ${FULLHOST_FROM} macro.) Please note that when a message traverses several relays, this macro contains the IP of the last relay.
A timestamp formatted according to the ts_format() global or per-destination option.
The time elapsed since the computer running syslog-ng OSE has booted. If this data is not available, the macro contains the time elapsed since syslog-ng OSE was started. The value of this macro is an integer containing the time in 1/100th of the second.
Available in syslog-ng OSE version 3.4 and later.
A comma-separated list of the tags assigned to the message.
An alias of the ${TZOFFSET} macro.
The time-zone as hour offset from GMT; for example: -07:00. In syslog-ng 1.6.x this used to be -0700 but as ${ISODATE} requires the colon it was added to ${TZOFFSET} as well.
The microsecond the message was sent.
Available in syslog-ng OSE version 3.4 and later.
The week number of the year, prefixed with a zero for the first nine week of the year. (The first Monday in the year marks the first week.)
These macros are deprecated, use ${WEEK_ABBREV}, ${R_WEEK_ABBREV}, ${S_WEEK_ABBREV} instead. The 3-letter name of the day of week the message was sent, for example Thu.
Published on July 21, 2016
© 2007-2016 Balabit SA
Send your comments to documentation@balabit.com
