I'm not sure what you're looking for for input, I can provide you what jboss writes to the local file system logs or the logs that rsyslog writes both of which show the hostname in the log and are written with the same log4j converstion format filter, and name the log as hostname.log. I've changed from parse_syslog to parse_syslog_bsd and nxlog still uses the ip address instead of the hostname. For the collection of these logs I will have to remain with rsyslog and sec. Thanks for your help in attempting to rectify this issue.
-----Original Message----- From: Botond Botyanszki [mailto:b...@nxlog.org] Sent: Thursday, December 19, 2013 9:46 AM To: nxlog-ce-users@lists.sourceforge.net Subject: Re: [nxlog-ce-users] Hostname resolution Hi, parse_syslog_bsd() will put the value parsed from the input into $Hostname, otherwise (on parse error) it will default to the value returned by the gethostname() system call. Since there was no sample provided for the input, I can't really tell more than what I wrote earlier. You could look at this by removing the "Exec to_syslog_bsd()" line from the file output, or check the udp payload with tcpdump/wireshark. Regards, Botond On Thu, 19 Dec 2013 09:02:31 -0700 "Paul Fontenot" <ssdv6...@gmail.com> wrote: > Here is how everything is configured > > JBoss syslog appenders (rsyslog appender shown as reference only) > ---------------------------------------------------------------------- > ------ > ---------------------- > <!-- Syslog events to rsyslog--> > <appender name="RSYSLOG" class="org.apache.log4j.net.SyslogAppender"> > <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> > <param name="Threshold" value="DEBUG"/> > <param name="SyslogHost" value="10.27.40.61:514"/> > <layout class="org.apache.log4j.PatternLayout"> > <param name="ConversionPattern" value="[%d{ABSOLUTE}] %-5p [%c] > %m%n"/> > </layout> > </appender> > > <!-- Syslog events to nxlog --> > <appender name="NXLOG" class="org.apache.log4j.net.SyslogAppender"> > <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> > <param name="Threshold" value="DEBUG"/> > <param name="SyslogHost" value="10.27.40.61:1514"/> > <layout class="org.apache.log4j.PatternLayout"> > <param name="ConversionPattern" value="[%d{ABSOLUTE}] %-5p [%c] > %m%n"/> > </layout> > </appender> > > > Nxlog configuration > ---------------------------------------------------------------------- > ------ > ---------------------- > define LOGDIR /var/nxlog > > ######################################## > # Modules # > ######################################## > <Extension _syslog> > Module xm_syslog > </Extension> > > ######################################## > # Inputs # > ######################################## > <Input udp-1514-in> > Module im_udp > Host 10.27.40.61 > Port 1514 > Exec parse_syslog(); > </Input> > > ######################################## > # Outputs # > ######################################## > <Output udp-1514-out> > Module om_file > File '%LOGDIR%/' + $Hostname + '.log' > Exec to_syslog_bsd(); > </Output> > > ######################################## > # Routes # > ######################################## > <Route udp-1514-route> > Path udp-1514-in => udp-1514-out > </Route> > > The rsyslog and local file system logs show the hostname of the > server, the nxlog appender is showing the ip address in the logs and > writing the log file name as 'ip_address.log' instead of 'hostname.log' > > -----Original Message----- > From: Botond Botyanszki [mailto:b...@nxlog.org] > Sent: Thursday, December 19, 2013 2:20 AM > To: nxlog-ce-users@lists.sourceforge.net > Subject: Re: [nxlog-ce-users] Hostname resolution > > Hi, > > Hostname comes from two sources, it can be already present in the > (sys)log, otherwise the gethostname(2) system call is used to retrieve and set it. > > Since you did not provide any information on how your input is > processed and what it looks like, it's kinda hard to help. > > Regards, > Botond > > > On Wed, 18 Dec 2013 11:51:53 -0700 > "Paul Fontenot" <ssdv6...@gmail.com> wrote: > > > Is there anything in nxlog that would affect hostname resolution? > > I'm sending jboss logs to nxlog and getting the ip address instead > > of the hostname - same logs are going to rsyslog as well and the > > hostname is in there as well as the local logs on the jboss server. > > > > > > -------------------------------------------------------------------- > > -- > > -------- Rapidly troubleshoot problems before they affect your > > business. Most IT organizations don't have a clear picture of how > > application performance affects their revenue. With AppDynamics, you > > get 100% visibility into your Java,.NET, & PHP application. Start > > your 15-day FREE TRIAL of AppDynamics Pro! > > http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg > > .c lktrk _______________________________________________ > > nxlog-ce-users mailing list > > nxlog-ce-users@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users > > ---------------------------------------------------------------------- > ------ > -- > Rapidly troubleshoot problems before they affect your business. Most > IT organizations don't have a clear picture of how application > performance affects their revenue. With AppDynamics, you get 100% > visibility into your Java,.NET, & PHP application. Start your 15-day > FREE TRIAL of AppDynamics Pro! > http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.c > lktrk _______________________________________________ > nxlog-ce-users mailing list > nxlog-ce-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users > ---------------------------------------------------------------------------- -- Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users ------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
