That's what I've been trying to work out too, I think if the hostname could be
used it would work which is why I tried changing the below template around so
that the %fromhost% part was %hostname% instead as this is one of the variables
from the rsyslog documentation and my understanding is that it should then use
the device hostname from the message. I wasn't sure how observium would then
pick it up as to whether it was looking at the position in the line and just
taking the first part as to the host to match it to or if there was more to it.
# observium syslog template
template(name="observium"
type="string"
string="%fromhost%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day%
%timereported:8:25%||%msg%||%programname%\n")
The below article shows how to store the messages by hostname in a different
log file which I think is the standard rsyslog way however I've never tried
this in the same scenario with multiple devices behind one public IP to be able
to reliably say if this works or not.
https://www.rsyslog.com/storing-and-forwarding-remote-messages/
I was trying to run debug in observium to see what it picks up but after
enabling it for syslog and also setting it to log unknown hosts I don't get any
additional logging to see what the lines look like for these hosts.
I did run tcpdump instead and it looks like the hostname is sent ok in the
syslog message so I think it's just a case of working out how to use that and
get it into observium.
_______________________________________________
observium mailing list -- [email protected]
To unsubscribe send an email to [email protected]
