neither example you give has the FQDN in the message, so it's not that it's
right in one place and wrong in another, it's that it's wrong in both places
At least that's how I think you are showing it.
However, since you are using an old version that's not supported by adiscon any
more (and not much by the community), you would need to see if the problem has
been fixed in one of the currently supported versions (which are the latest
6.<even> and 7.x)
now, the link you point to involves stunnel, which changes what IP (and therefor
what DNS host) the message comes from.
It's possible that the FQDN is not in the message you are recieving in the first
place, please log with RSYSLOG_DebugFormat so we can see what data is in the log
message.
David Lang
On Thu, 28 Feb 2013, root wrote:
no,i want ask quetions like this
http://lists.adiscon.net/pipermail/rsyslog/2010-March/011649.html
and my agent version is
[root@l-agentlog /etc]# rsyslogd -v
rsyslogd 5.8.10, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
See http://www.rsyslog.com for more information.
seem like this version has problem for PreserveFQDN?
thanks&Best Regards
From: Rainer Gerhards
Date: 2013-02-28 19:43
To: [email protected]
Subject: Re: [rsyslog] agent hostname parse incorrect
The Hostname looks the same in both samples you provided...
Sent from phone, thus brief.
-------- Urspr?ngliche Nachricht --------
Von: root <[email protected]>
Datum: 28.02.2013 11:42 (GMT+01:00)
An: rsyslog <[email protected]>
Betreff: [rsyslog] agent hostname parse incorrect
hi,all
now,my log agent use rsyslog 5.8.x,and configure like this
$PreserveFQDN on
#$LocalHostName l-craw1.vc.cn6
*.*;mail.none @l-logserver.s1
and in l-logserver.s1,configure like this
$template TraditionalFormatWithPRI,"%pri-text%: %timegenerated% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n"
$template SepFile,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
*.* ?SepFile;TraditionalFormatWithPRI
but in the hosts directory,we see incorrect HOSTNAME
daemon.info: Feb 28 18:37:03 l-logagent snmpd[2637]: Connection from UDP:
[192.168.224.16]:50423->[192.168.232.43]
but,at the same time,has correct HOSTNAME write
kern.info: Feb 28 18:30:31 l-logagent kernel: imklog 5.8.10, log source =
/proc/kmsg started.
syslog.info: Feb 28 18:30:31 l-logagent rsyslogd: [origin software="rsyslogd" swVersion="5.8.10"
x-pid="24572" x-info="http://www.rsyslog.com";] start
why this?what happen?
seem like about facility or priority related !!
thanks&Best Regards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
