I have multiple Audiocodes SBCs sending syslog data to our Kiwi Syslog server (currently on version 9.7.0.167).
I have setup a forwarding rule there that forwards all of the equipment's logs out to one of two addresses (depending on whether I am working from the office or remote) so I can troubleshoot call issues on my laptop using the Audiocodes Syslog Viewer.
When I send directly from the device to my laptop's Audiocodes Syslog Viewer I am able to reconstruct the calls (shows ladder diagram, etc).
When I forward it from Kiwi, there is extra text in there that messes up the Audiocodes Syslog Viewer as I believe it must parse it based on spaces and the extra text just wrecks it.
I am using the following 2 options, "Send with RFC 3164 header information" and 'Retain the original source address of the message".
I have used the registry hack to remove the "Original Address=" prefix but the system still includes "Kiwi_Syslog_Server " in the file and that introduces another field/space so I cannot reconstruct calls.
Direct Syslog Connection to System: 11:14:11.939 10.xxx.xxx.xxx local0.notice [S=430346308] [BID=a6d2b5:22] (N 28418467)
Kiwi Forwarding Syslog Before Registry Hack: 11:14:11.939 Kiwi_Syslog_Server Original Address=10.xxx.xxx.xxx local0.notice [S=430346308] [BID=a6d2b5:22] (N 28418467)
Kiwi Forwarding Syslog After Registry Hack: 11:14:11.939 Kiwi_Syslog_Server 10.xxx.xxx.xxx local0.notice [S=430346308] [BID=a6d2b5:22] (N 28418467)
Is there anyway I can get rid of that "Kiwi_Syslog_Server " field/addition?