Hello, I have a parsing issue with the following Linux log :<37>Jan 4
19:56:01 hostname PAM-unixteam[2373]: pam_sm_acct_mgmt(service=crond,
terminal=cron, user=root, ruser=UNDEF, rhost=UNDEF)This log is not
matching rhlinux devices type and is parsed...
Hello Dave, Thank you for your answer.I still don't have any way to
change syslog configuration.Do you know why windows log with PRI is well
parsed ? <133>Jan 5 23:04:42 hostname MSWinEventLog 1 Security 202206857
Tue Jan 05 23:04:42 2021 4648 Micros...
Below the packet we see with the tcpdump :
[][][10.10.10.10][1622212150][]<37>Jan 6 21:22:30 hostname
PAM-unixteam[110242]: pam_sm_close_session(service=crond, terminal=cron,
user=xxxx, ruser=UNDEF, rhost=UNDEF)Thanks
Hello Dave,Thank you for your answer. We don't see parsing errors, the
log is just not parsed (match unknown device type).This log is coming
through a relay adding this PRI tag and currently it's impossible to
access on this relay and remove the tag....
