Log to File action does not resolve legacy filename variables after migration to Kiwi Syslog Server NG

After migrating from Kiwi Syslog Server Legacy to Kiwi Syslog Server NG using the migration wizard, the "Log to File" action creates files with literal legacy variable text (e.g., %HostName-%DateD2%DateM2%DateY4.txt) instead of replacing those variables with actual values. The behavior differs from the legacy server, where the same filename pattern correctly produces dynamic filenames (e.g., 10.14.11.123-01032025.txt). The issue is due to differences in variable syntax/handling between Legacy and NG, and is resolved by updating the filename pattern to use NG-supported variables.

• The configuration was migrated from a legacy Kiwi Syslog Server instance using the migration wizard (importing the old .ini file).

• In the legacy system, filename variables such as:

  • %HostName

  • %DateD2

  • %DateM2

  • %DateY4
    were valid and automatically expanded when used in the "Log to File" action.

• Kiwi Syslog Server NG uses a different variable syntax and variable model for filenames:

  • It does not interpret or expand the old %VariableName% style tokens in filenames.

  • It expects NG-style variables (AutoSplit variables or $Message.* properties) inserted via the UI.

• The migration wizard:

  • Imports the legacy configuration values as plain text.

  • Does not translate legacy filename variables into the NG variable format.

As a result, the filename %HostName-%DateD2%DateM2%DateY4.txt is treated as a literal string in NG and is written exactly as-is, instead of being expanded.

Resolution

In Kiwi Syslog Server NG, legacy filename variables are not supported in the “Log to File” action.

To resolve this issue:

1. Open the affected rule in Kiwi Syslog Server NG.

2. Navigate to the Log to File action.

3. Update the Log file name field to use NG-supported variables.

4. Click the variable selection icon next to the filename field.

5. Choose from supported NG variables such as:

   • $Message.Hostname

   • $Message.SourceIP

   • $Message.DateISO

   • AutoSplit variables derived from the message content

6. Save the rule and test by sending matching syslog traffic.
   
   Note:
   The Migration Wizard does not automatically convert legacy filename variables to NG format. Manual adjustment of log file names is required after migration.
   
   
   Reference documentations: Reference: Log each message to a file based on the date and sending device in KSS NG  and Client script - cl. variables and functions