On Tue, 7 Feb 2012, Rory Toma wrote:
On 2/7/12 1:49 PM, [email protected] wrote:
On Tue, 7 Feb 2012, Rory Toma wrote:
I am setting up an rsyslog server whose sole purpose is to decompress and
unencrypt, then forward the messages on to a centralized syslog server.
I seem to be having trouble getting it to preserve the original message,
so that the hostname is from the original sender. I tried using
PreserveFQDN, but that doesn't seem to be working, and I can't seem to
find an example in the rsyslog docs on how to do this. Is this a simple
option, or do I have to set up a template?
if your template uses %hostname% it will preserve what was in the message.
If you use %fromhost% of %fromhost-ip% it will log the machine the message
was received from.
my guess is that you use fromhost on your central server.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
I am currently using no template, or the default template. That must use
hostname, so I probably have to create my own template... Now I'll have to go
dig out the instructions for that again, I did that once, a long time ago.
8-)
what is it that you are getting logged, and what are you expecting to get?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
