Hi,

i'm trying syslog-ng to get ip address from dhcp log

so i need to have the frameipaddress field to be empty in order to replace it from dhcp log

so in syslog-ng.conf, i put :

source dhcp {
        tcp(ip(0.0.0.0) port(514));
};
#
log {
      source(dhcp);
      destination(acct_radius);
};

destination acct_radius { pipe("/var/log/mysql.pipe" \
template("UPDATE radacct SET FramedIPAddress = SUBSTRING_INDEX(SUBSTRING_INDEX('$MSG','on ',-1),' to',1) \
WHERE TIMESTAMPDIFF(SECOND,AcctStartTime,CONCAT('$YEAR-$MONTH-$DAY',' ','$HOUR:$MIN:$SEC')) <= 180 AND \
REPLACE(REPLACE(CallingStationId,'-',''),':','') = REPLACE(SUBSTRING(SUBSTRING_INDEX('$MSG','to ',-1),1,17),':','') \
AND FramedIPAddress = \"\" ;\n") template-escape(yes));
};

but my FramedIPAddress field still got this strange ip adress 3.118.236.192

somebody has a clue?

thanks