Can I use a more advanced template for extracting $PROGRAM in syslog-ng?

Question

Hi

I am sending messages to Syslog using two Apache SyslogAppenders in Java. My ConversionPatterns are:

Instance-${jboss.server.name}: %d %-5p [%c] (%t) %m%n
Application-MyApp: ${jboss.server.name} - %d %-5p [%c] (%t) %m%n

I then have different Log4J categories configured to send different messages to either one of, or both appenders.

In my syslog configuration file, I have:

destination d_jboss_appli_integ {
    file("/var/log/syslog-ng/JBoss/intg/Applications/$PROGRAM/$YEAR$MONTH$DAY.log"
    template("Application-$PROGRAM: $MSG\n"));
};
destination d_jboss_instance_integ {
    file("/var/log/syslog-ng/JBoss/intg/Instances/$PROGRAM/$YEAR$MONTH$DAY.log"
    template("Instance-$PROGRAM: $MSG\n"));
};

Like this, what I want to have is logging to a file in /var/log/syslog-ng/JBoss/intg/Applications/MyApp/ and to a file in /var/log/syslog-ng/JBoss/intg/Instances/${jboss.server.name}/ where ${jboss.server.name} is replaced by the name of the JBoss server.

Instead I am getting logs written to folders called Application-MyApp and Instance-${jboss.server.name}.

Is it possible to use the template() directive in Syslog to properly extract the value of $PROGRAM from the messages, getting MyApp and ${jboss.server.name} respectively?

Thanks in advance

Rich

ps: just to be clear ${jboss.server.name} is being properly expanded everywhere.

Answer 1

I found a solution: change the format of the messages so that the value that you want as the value of $PROGRAM is the only value before the first colon:

So, the following:

Instance-${jboss.server.name}: %d %-5p [%c] (%t) %m%n
Application-MyApp: ${jboss.server.name} - %d %-5p [%c] (%t) %m%n

Becomes:

${jboss.server.name}:Instance: %d %-5p [%c] (%t) %m%n
MyApp:Application:${jboss.server.name}: - %d %-5p [%c] (%t) %m%n

That way, the template correctly returns what I want.