hi thank you reply it,i will be try update to new version.
thanks&Best Regards From: David Lang Date: 2013-03-01 03:54 To: rsyslog-users Subject: Re: [rsyslog] agent hostname parse incorrect neither example you give has the FQDN in the message, so it's not that it's right in one place and wrong in another, it's that it's wrong in both places At least that's how I think you are showing it. However, since you are using an old version that's not supported by adiscon any more (and not much by the community), you would need to see if the problem has been fixed in one of the currently supported versions (which are the latest 6.<even> and 7.x) now, the link you point to involves stunnel, which changes what IP (and therefor what DNS host) the message comes from. It's possible that the FQDN is not in the message you are recieving in the first place, please log with RSYSLOG_DebugFormat so we can see what data is in the log message. David Lang On Thu, 28 Feb 2013, root wrote: > no,i want ask quetions like this > > http://lists.adiscon.net/pipermail/rsyslog/2010-March/011649.html > > > and my agent version is > > [root@l-agentlog /etc]# rsyslogd -v > rsyslogd 5.8.10, compiled with: > FEATURE_REGEXP: Yes > FEATURE_LARGEFILE: No > GSSAPI Kerberos 5 support: Yes > FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes > 64bit Atomic operations supported: Yes > Runtime Instrumentation (slow code): No > > See http://www.rsyslog.com for more information. > > seem like this version has problem for PreserveFQDN? > > > > > > > > thanks&Best Regards > > From: Rainer Gerhards > Date: 2013-02-28 19:43 > To: [email protected] > Subject: Re: [rsyslog] agent hostname parse incorrect > The Hostname looks the same in both samples you provided... > > > Sent from phone, thus brief. > > > > -------- Urspr?ngliche Nachricht -------- > Von: root <[email protected]> > Datum: 28.02.2013 11:42 (GMT+01:00) > An: rsyslog <[email protected]> > Betreff: [rsyslog] agent hostname parse incorrect > > > hi,all > > now,my log agent use rsyslog 5.8.x,and configure like this > > $PreserveFQDN on > > #$LocalHostName l-craw1.vc.cn6 > > *.*;mail.none @l-logserver.s1 > > and in l-logserver.s1,configure like this > > > $template TraditionalFormatWithPRI,"%pri-text%: %timegenerated% %HOSTNAME% > %syslogtag%%msg:::drop-last-lf%\n" > $template SepFile,"/var/log/hosts/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log" > *.* ?SepFile;TraditionalFormatWithPRI > > but in the hosts directory,we see incorrect HOSTNAME > > daemon.info: Feb 28 18:37:03 l-logagent snmpd[2637]: Connection from UDP: > [192.168.224.16]:50423->[192.168.232.43] > > but,at the same time,has correct HOSTNAME write > > kern.info: Feb 28 18:30:31 l-logagent kernel: imklog 5.8.10, log source = > /proc/kmsg started. > syslog.info: Feb 28 18:30:31 l-logagent rsyslogd: [origin software="rsyslogd" > swVersion="5.8.10" x-pid="24572" x-info="http://www.rsyslog.com";] start > > > why this?what happen? > > seem like about facility or priority related !! > > > thanks&Best Regards > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
