I'm using rsyslog to send access & error log data to a remote server.  The interface is in place, but I'm getting an extra bit of text in the outbound log data that isn't included in /var/log/http/access_log. Here's a snippet from an access_log entry.  1.1.1.1 is my IP address, and 99.99.99.99 is the appserver's IP.  1.1.1.1 99.99.99.99 - - [29/Jun/2015:11:57:58 -0400] GET /somepage.php HTTP/1.1 200 443 20Corresponding outbound log data sent by rsyslog usingtcpdump -vv -s 0 -A dst port 514 from the appserver (sending machine): <173>Jun 29 11:57:58 appserver acoder: 1.1.1.1 99.99.99.99 - -  [29/Jun/2015:11:57:58 -0400] GET /somepage.php HTTP/1.1 200 443 20How do I remove the first few segments of the outbound log data?  Specifically: Jun 29 11:57:58 appserver acoder: I'd like that string removed so the only thing that is being sent is exactly what is in the access_log shown in the first quote above.  httpd.conf## LogLevel: Control the number of messages logged to the error_log.# Possible values include: debug, info, notice, warn, error, crit,# alert, emerg.## LogLevel warnLogLevel debug## The following directives define some format nicknames for use with# a CustomLog directive (see below).LogFormat %h %A %l %u %t \%r\ %>s %p %b combinedLogFormat %h %A %l %u %t \%r\ %>s %p %b commonLogFormat %{Referer}i -> %U refererLogFormat %{User-agent}i agentrsyslog.conf# rsyslog v5 configuration file# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html#### MODULES ####$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog   # provides kernel logging support (previously done by rklogd)#### GLOBAL DIRECTIVES ##### Use default timestamp format$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# Include all config files in /etc/rsyslog.d/$IncludeConfig /etc/rsyslog.d/*.conf#### RULES ##### Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none                /var/log/messages# The authpriv file has restricted access.authpriv.*                                              /var/log/secure# Log all the mail messages in one place.mail.*                                                  -/var/log/maillog# Log cron stuffcron.*                                                  /var/log/cron# Everybody gets emergency messages*.emerg                                                 *# Save news errors of level crit and higher in a special file.uucp,news.crit                                          /var/log/spooler# Save boot messages also to boot.loglocal7.*                                                /var/log/boot.log# ### begin forwarding rule #### The statement between the begin ... end define a SINGLE forwarding# rule. They belong together, do NOT split them. If you create multiple# forwarding rules, duplicate the whole block!# Remote Logging (we use TCP for reliable delivery)## An on-disk queue is created for this action. If the remote host is# down, messages are spooled to disk and sent when it is up again.local5.*;local6.* @syslog.my.organization.tld:514# ### end of the forwarding rule ###
rsyslog adding unwanted text to outbound log data
centos;rsyslog;apache httpd