David,
thanks a lot. Everything is working fine now! Thanks for clarifying me this.
Xavi
>>> right now you have two choices.
>>>
>>> 1. put the HOST_ID in place of the servername in your template so that it
>>> gets parsed as %hostname%
>>>
>>>
>> Correct me if I am wrong. Do you mean I should change something like (in
>> the client):
>>
>> $template hostID,"%TIMESTAMP% *%HOSTNAME%* %syslogtag%
>>
>> %syslogfacility-text% %syslogseverity% %msg%\n"
>>
>> to
>>
>> $template hostID,"%TIMESTAMP% *01-1V8IMU1* %syslogtag%
>>
>> %syslogfacility-text% %syslogseverity% %msg%\n" ?
>>
>> ...
>>
>> *.* :omrelp:127.0.0.1:20500;hostID
>>
>>
>> and then, in the server, I will be able to replace the regular expression
>>
>> $Template Dyn_messages,
>> "/var/log//xavi/%msg:R,ERE,0,**DFLT:01\-[0-9A-Z]{7}--end%/**messages"
>>
>> for
>>
>> $Template Dyn_messages, "/var/log/xavi/%HOSTNAME%/**messages" ?
>>
>
> yes. or more precisely, almost, the template should have <%PRI%> before
> the timestamp when forwarding.
>
>
> I don't understand how rsyslog from server knows %HOSTNAME% is the tag I
>> hardcoded in the client template.
>>
>
> the receiving syslog daemon parses the inbound message according to the
> RFC standards. This say that the string after the timestamp is the
> hostname. It doesn't know if it's really the hostname or not (the sender
> can lie, as I am suggesting that you do in this case), but it assumes that
> it is the hostname and puts it in the hostname property.
>
> David Lang
>
> ______________________________**_________________
> rsyslog mailing list
> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
