WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / How To Add A Tag (Log prefix) To Syslog Entries

How To Add A Tag (Log prefix) To Syslog Entries

05.07.2013 by William Lam // 2 Comments

Last year I wrote an article on how to forward vCenter Server logs to a remote syslog server using the built in syslog-ng client in the VCSA. A few weeks back, I received an interesting email from Michael White sharing details about adding a "tag" or more specifically, adding a string prefix to each syslog entry being forwarded. This was interesting as it enables a user to easily search for a specific log entry based on a "tag" and comes really in handy when you have multiple log sources being forwarded from the same host. An example of this would be the various logs from a vCenter Server such as vpxd, vws, inventoryservice, etc. which all have their own individual logs coming from the same host.

Within the Syslog-ng client configuration, you can specify the log_prefix() option and the string you wish to prefix a given log source. The tag has a specific syntax that must contain a : (colon) and a whitespace after the string (e.g. "VC_APP: ").

Using the vCenter Server as example, we could add the following tags:
After restarting the syslog-ng client for the changes to going into effect, you can head over to your syslog server to view the updated syslog entries. In the screenshot below, we can see we have log sources from both our VC_APP (vpxd.log) and VC_IS (ds.log) entries as specified in our syslog-ng client configurations.

Note: For newer versions of syslog-ng, program_override() is used instead of log_prefix(). The syntax for that would be program_override("VC_APP").

I want to thank Michael for sharing this cool tidbit!

More from my site

  • Enhanced vCenter Server Audit Event & Logging in vSphere 6.7 Update 2
  • A preview of native syslog support in VCSA 6.0
  • Forwarding vCenter Server Logs to a Syslog Server
  • How to deploy the vCenter Server Appliance (VCSA) 8.0 to VMware Fusion or Workstation?
  • Quick Tip - How to disable viewing of vSphere Tags?

Categories // Uncategorized Tags // syslog, tag, vcsa

Comments

  1. Akshatha says

    09/15/2014 at 7:29 pm

    thanks for the info. How do i add log prefix in syslog-ng_conf if i wnat the string "ABC" to be added if the $program sending message is httpd?

    i have my syslog.conf reading messages from
    file ("/proc/kmsg" log_prefix("kernel: "));
    unix-stream ("/dev/log");
    internal()

    and message is sent as

    template t_filetmpl { template("$ISODATE $FACILITY $HOST $PROGRAM[$PID]: $LEVEL $MSGONLY\n"); template_escape(no); };

    destination d_mesg { file("/var/log/messages" template(t_filetmpl)); };

    log { source(s_syslogng); source (s_internal);
    destination(d_mesg); };

    Reply

Trackbacks

  1. Syslog Agents on Linux - SFlanders.net says:
    12/21/2014 at 2:47 am

    […] Syslog messages can be modified and support the addition of tags making querying easier. For a great example on how and why to tag logs see: http://www.virtuallyghetto.com/2013/05/how-to-add-tag-log-prefix-to-syslog.html. […]

    Reply

Thanks for the comment! Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native technologies, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC)

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • How to disable the Efficiency Cores (E-cores) on an Intel NUC? 03/24/2023
  • Changing the default HTTP(s) Reverse Proxy Ports on ESXi 8.0 03/22/2023
  • NFS Multi-Connections in vSphere 8.0 Update 1 03/20/2023
  • Quick Tip - How to download ESXi ISO image for all releases including patch updates? 03/15/2023
  • SSD with multiple NVMe namespaces for VMware Homelab 03/14/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023