On Tue, 20 Apr 2010, Tom Brown wrote: > Hi - i posted this on the forum but i wonder of the maillist gets more > traffic > > > I am sending syslog data from a number of hosts to a central rsyslog box and > everything is working but i have a basic configuration query. > I currently log to /logs/<hostname>/<date>/*.log which is working fine but i > am lacking a <hostname> parameter in each log. The logs are appearing in the > correct <hostname> directory but my munging scripts rely on knowing what > host each log comes from but as this is not appearing in the actual log then > this makes things difficult. Does anyone have any pointers for achieving > that, right now an example of a log would be > > # cat 20100419-<hostname>-authpriv.log > pam_unix(su-l:session): session closed for user root > pam_unix(sshd:session): session closed for user XXXXXX > > and ideally this would read > > # cat 20100419-<hostname>-authpriv.log > <hostname> pam_unix(su-l:session): session closed for user root > <hostname> pam_unix(sshd:session): session closed for user XXXXXX
what is your current configuration? it sounds like you need to change the format string to include the hostname. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
