On Tue, 7 Feb 2012, Rory Toma wrote:
I am setting up an rsyslog server whose sole purpose is to decompress and
unencrypt, then forward the messages on to a centralized syslog server.
I seem to be having trouble getting it to preserve the original message, so
that the hostname is from the original sender. I tried using PreserveFQDN,
but that doesn't seem to be working, and I can't seem to find an example in
the rsyslog docs on how to do this. Is this a simple option, or do I have to
set up a template?
if your template uses %hostname% it will preserve what was in the message.
If you use %fromhost% of %fromhost-ip% it will log the machine the message
was received from.
my guess is that you use fromhost on your central server.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
