change in the format of syslog after upgrading
Article ID: 408632
Updated On:
Products
Issue/Introduction
We have observed an extra field in the new version 11.1.2 compared to the 10.1 in the syslog format. below are the examples.
There is an extra "[]" just before the log severity in 11.1.2 version.
Why the new field is there and is there a way to get remove it
v10.1
2025-06-16T09:01:34.598+01:00 xxxxxxx SSG[605]: INFO com.l7tech.message.HttpCookiesKnobImpl: Removing cookies:
v11.1.2
2025-06-16T09:02:01.927+01:00 xxxxxxxx SSG[192]: [] INFO com.l7tech.server.policy.assertion.ServerAuditDetailAssertion: -4:
Resolution
This is a sideeffect of a library update which will be fixed in the next gateway release 11.1.3
To remove this field now you can do the following:
nano /opt/SecureSpan/Gateway/node/default/etc/conf/ssglog.properties
sink.format.syslog.STANDARD =%2$s %3$s: %4$s
The above line will update the log format for a log sink called syslog .
You need to add a line for each syslog sink log you have defined
sink.format.<sinklogname>.STANDARD =%2$s %3$s: %4$s
Feedback
