This is more of a proposal than a question...
I'm onboarding data for a number of Juniper SRX appliances using a syslog server running rsyslog and a UF. While I could override the source to be "jnpr-syslog" rather than the monitored file's path, I would like to propose that a different "fix" would be to:
Create an eventtypes.conf that contained:
[jnpr-syslog]
definition = source=jnpr-syslog
Replace all instances of 'source="jnpr-syslog"' in the XML files for the views with 'eventtype=jnpr-syslog'.
In this way, the app would behave exactly as it currently does but, importantly, it would also allow for the definition of the jnpr-syslog eventtype to be easily overridden locally if needed.
I'm not sure if the author is still maintaining the app. If not I'll make the changes locally myself.
