On Wed, 22 Jan 2014, Charles wrote:
Hello rsyslog mailing list :)
This question was originally asked at Linux Questions
http://www.linuxquestions.org/questions/showthread.php?p=5100704
but was not solved.
Our hostnames are only unique when the first two parts of the FQDN are
used. For example: server.london.example.com and server.mumbai.example.com.
Messages in /var/log/syslog look for example like:
Jan 19 15:02:04 server postfix/qmgr[5378]: 6BBD62D6059: removed
Can rsyslog be configured to change "server" in the above message to
"server.mumbai"?
Research suggested the PropertyReplacer could do that. The preamble on
http://www.rsyslog.com/doc/property_replacer.html says "A syslog message
has a number of well-defined properties (see below). Each of this
properties can be accessed and manipulated by the property replacer.
With it, it is easy to use only part of a property value or manipulate
the value, e.g. by converting all characters to lower case.".
Encouraging; maybe ...
%fromhost-ip:::127.0.0.1:<something>
... but I could not identify the right <something>. The rsyslog
documentation at http://www.rsyslog.com/doc/property_replacer.html, in
the section on Property Options, gives Name as a possible option and
says it is a "template / property / constant". The "constant" looks
promising but what is it? No further documentation or usage examples
about "constant" found.
Maybe rsyslog can't assign a value to a property. David Lang (who
appears often on the Internet, giving apparently sound advice about
rsyslog) says exactly that at
http://www.gossamer-threads.com/list...sers/6221#6221.
You cannot change one of the default properties, with v7 you can create and use
your own variables, but in this case, that's not what you are really needing.
Instead of trying to change one of the existing properties, the thing to do is
to create a new template instead of using one of the defaults. Then in place of
the %hostname% field you can put whatever you want.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
