Thank you David - I was able to figure it out using a template: template(name="getFQDN" type="string" string="%timegenerated% %FROMHOST-IP% %FROMHOST% %syslogtag%%msg%\n")
The resulting log entries have the source IP as well as the FQDN. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Wednesday, April 01, 2015 2:20 PM To: rsyslog-users Subject: Re: [rsyslog] Capturing IP & FQDN Yes, the result is not going to be RFC complient, but if you are the onlyone using it, who cares ;-) log some messages using the RSYSLOG_DebugFormat and you will see all the different variables that are populated for a message. things get more 'interesting' if you are talking about relaying through multiple syslog servers, but there's no need to get into those details unless that's what you are doing. David Lang On Wed, 1 Apr 2015, Heaton, Tobias wrote: > Date: Wed, 1 Apr 2015 15:44:43 +0000 > From: "Heaton, Tobias" <[email protected]> > Reply-To: rsyslog-users <[email protected]> > To: "'[email protected]'" <[email protected]> > Subject: [rsyslog] Capturing IP & FQDN > > I have an rsyslog server setup receiving messages from a machine that is only > sending IP address (example below). I'd like to be able to add the FQDN of > the IP address in the log message. Is this possible with property replacers? > I only have limited experience using property replacement so any advice would > be appreciated - thanks! > > Current Syslog Example: > Apr 1 10:00:00 11.22.33.44 SysLogTag SysLogMessage > > What I'm trying to achieve: > Apr 1 10:00:00 11.22.33.44 thedomain.com SysLogTag SysLogMessage > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
