Hello rsyslog mailing list :) This question was originally asked at Linux Questions http://www.linuxquestions.org/questions/showthread.php?p=5100704 but was not solved.
Our hostnames are only unique when the first two parts of the FQDN are used. For example: server.london.example.com and server.mumbai.example.com. Messages in /var/log/syslog look for example like: Jan 19 15:02:04 server postfix/qmgr[5378]: 6BBD62D6059: removed Can rsyslog be configured to change "server" in the above message to "server.mumbai"? Research suggested the PropertyReplacer could do that. The preamble on http://www.rsyslog.com/doc/property_replacer.html says "A syslog message has a number of well-defined properties (see below). Each of this properties can be accessed and manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.". Encouraging; maybe ... %fromhost-ip:::127.0.0.1:<something> ... but I could not identify the right <something>. The rsyslog documentation at http://www.rsyslog.com/doc/property_replacer.html, in the section on Property Options, gives Name as a possible option and says it is a "template / property / constant". The "constant" looks promising but what is it? No further documentation or usage examples about "constant" found. Maybe rsyslog can't assign a value to a property. David Lang (who appears often on the Internet, giving apparently sound advice about rsyslog) says exactly that at http://www.gossamer-threads.com/list...sers/6221#6221. Best Charles _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
