format-cef-extension with --scope syslog

[jszigetvari]

A user reported that with the latest PE build (the relevant code should be shared between PE and OSE), they were trying to use the format-cef-extension template function as shown in the Admin Guide, and they got a config parse error:

Error parsing affile, Error compiling template, error=Error parsing value-pairs: unknown scope syslog in /.../etc/syslog-ng.conf:49:50-49:111:

49----> destination d_cef { file("/var/log/cef" template("${ISODATE} ${HOST} $(format-cef-extension --scope syslog)\n")); };
49----> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[gaborznagy]

Hi,

We only have syslog-proto scope, and alias to that is rfc5424.

(It's a bit confusing if you compare this to the syslog-protocol flag of the source drivers)

I see some documentation bugs, namely that we show syslog scope in example while it's a not existing scope.
See here in value-pairs() chapter: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.33/administration-guide/10#TOPIC-1663185
and here in template functions chapter:
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.33/administration-guide/68#TOPIC-1663419

IMHO we should correct the invalid scope value from the examples in the documentation to rfc5424.

[gaborznagy]

Of course, we should see how does $(format-cef-extension) work with rfc5424 scope.

[HofiOne]

Documentation and its issues moved
syslog-ng/syslog-ng.github.io#131