how to get rid of syslog program column

[ajmal2021]

Dear all,

Remove.JPG (63.3 KiB) Viewed 7941 times

We are trying to remove the program column from the cacti syslog view. The incoming logs are somehow split between the program and the message columns. We do not know how the splitting takes place, whether using a , : or space.

So in short we want to avoid splitting the incoming logs between the program and message columns and also get rid of the program column from cacti view at all.

Any help would be appreciated.

Thanks in advance

[cigamit]

Your problem probably isn't in the display, Cacti isn't splitting the data to display it. It's not like its CSV file or any, each of those columns is a field in the DB. It's probably your script that is inputting the stuff into syslog_incoming where the problem lies.

[ajmal2021]

Thank you for the reply. You are right, it is not the display but the question is which script are we talking exactly about, where to find it and if the splitting happens by a , ; : or space?

[cigamit]

The script isn't part of Cacti itself, so it really depends on what syslog program you are using on your server. If its rsyslog, its probably in /etc/rsyslog.d/ somewhere. And again, even in the script, nothing splits along commas, spaces, etc... its not CSV data. The syslog format is very specific in how its data is structured.

https://datatracker.ietf.org/doc/html/rfc5424

[ajmal2021]

I will read what is there in the link and see if I could get this done.

Thank you so much for taking the time to reply.