mjhjmtu

In the below configuration,

@version: 3.17

source s_network 
 udp(
 flags(syslog_protocol)
 keep_hostname(yes)
 keep_timestamp(yes)
 use_dns(no)
 use_fqdn(no)
 );
;

destination d_all_logs 
 file("/app/syslog-ng/custom/output/all_devices.log");

;


log 
 source(s_network);
 destination(d_all_logs);
;

incoming message is:

[root@machine ~]# tcpdump -v dst port 514
 14:41:30.097509 IP (tos 0x0, ttl 243, id 4483, offset 0, flags [none], proto UDP (17), length 127)
 machine2.def.com.49239 > machine.abc.com.syslog: SYSLOG, length: 99
 Facility local7 (23), Severity error (3)
 Msg: 4483: 030842: Oct 30 18:41:30.081 UTC: %SYS-3-DUP_TIMER: Same tty2 in linewatch_timers, type 2

where nslookup machine2.def.com gives 10.69.20.11

that is stored as

[root@machine ~]# cat /app/syslog-ng/custom/output/all_devices.log | grep "030842: Oct 30 18:41:30.081"
 Oct 30 14:41:30 10.69.20.11 030842: Oct 30 18:41:30.081 UTC: %SYS-3-DUP_TIMER: Same tty2 in linewatch_timers, type 2

syslog-ng running on machine appends its own time stamp in log file(Oct 30 14:41:30), in addition to sender's timestamp.

Message should look like Oct 30 18:41:30.081 UTC 10.69.20.11 030842: %SYS-3-DUP_TIMER: Same tty2 in linewatch_timers, type 2

What are the changes required in the configuration?

For modifying the logs to the format you intend, you edit the syslog-ng.conf file.

You then define an output syslog template. It should be something similar to:

template template_format 
 template("$MSGHDR $HOST $MSGn");
 template_escape(no);
;

and then apply the template to the destination as in:

destination d_all_logs 
 file("/app/syslog-ng/custom/output/all_devices.log" template(template_format) );
 ;

Do not forget to restart syslog-ng