syslog-ng on AsusWRT Merlin

services-start

#!/bin/sh
alias log="logger -p user.info -t services-start"

RC='/opt/etc/init.d/rc.unslung'

i=30
until [ -x "$RC" ] ; do
  i=$(($i-1))
  if [ "$i" -lt 1 ] ; then
    log Could not start Entware
    exit
  fi
  sleep 1
done
$RC start

i=30
until [ -p "/tmp/syslog-ng-pipe" ] ; do
  i=$(($i-1))
  if [ "$i" -lt 1 ] ; then
    log "Could not send startup log to syslog-ng"
    exit
  fi
  sleep 1
done
cat /tmp/syslog.log > /tmp/syslog-ng-pipe

syslog-ng.conf

@version:3.9

options {
        chain_hostnames(no);
        create_dirs(yes);
        flush_lines(0);
        keep_hostname(yes);
        log_fifo_size(4096);
        stats_freq(0);
        flush_lines(0);
        use_dns(yes);
        use_fqdn(no);
        dns-cache-hosts(/etc/hosts.dnsmasq);
};

filter bad_program {
        not match(": $" value("MSGHDR")) and match("^([^:]*): *((?:.|\n)*)$" flags(store-matches) value("MESSAGE"));
};

rewrite rewrite_program {
        subst(' ', '_', value("1"), flags(global));
        set("${PROGRAM}_$1", value("PROGRAM"));
        set("$2", value("MESSAGE"));
};

source net {
        network(
                ip("192.168.0.1")
                transport("udp")
                port(514)
                flags(no-hostname)
        );
};

source named_pipe {
        pipe("/tmp/syslog-ng-pipe");
};

source fixed_net_and_pipe {
        channel {
                source(net);
                source(named_pipe);
                junction {
                        channel { filter(bad_program); rewrite(rewrite_program); flags(final);};
                        channel { };
                };
        };
};

destination messages {
        file("/mnt/usb/logs/${HOST_FROM}/${C_YEAR}-${C_MONTH}.log" flags(syslog-protocol));
};

destination log_server {
        syslog("192.168.0.2"
                transport("tcp")
                port(601)
        );
};

log {
        source { internal(); };
        source(fixed_net_and_pipe);
        destination(messages);
        destination(log_server);
};

For context, see https://www.snbforums.com/threads/configuring-syslog-ng-with-merlin-firmware.35095/page-2#post-335232