On 22/01/14 14:17, [email protected] wrote: >> > Messages in /var/log/syslog look for example like: >> > >> > Jan 19 15:02:04 server postfix/qmgr[5378]: 6BBD62D6059: removed >> > >> > Can rsyslog be configured to change "server" in the above message to >> > "server.mumbai"? > > Instead of trying to change one of the existing properties, the thing to do > is > to create a new template instead of using one of the defaults. Then in place > of > the %hostname% field you can put whatever you want.
Thanks David :-) Given that pointer -- and after realising that -c4 made our rsyslog version 6.4 behave in version 4 compatibility mode so list templates were not an option -- it was straightforward. The solution was to create this two line /etc/rsyslog.d/FileFormat.template.conf file (the $template data is on a single line) ... $template FileFormat,"%timegenerated% server.london %syslogtag%%msg:::drop-last-lf%\n" $ActionFileDefaultTemplate FileFormat ... and restart rsyslogd. In case it matters, this was on Debian 6 squeeze where /etc/rsyslog.conf has: $IncludeConfig /etc/rsyslog.d/*.conf _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
