on the receiving system you can use fromhost-ip in a template. On the sending
system there is not a good way of knowing for sure what the IP address of the
system is (it can have multiple IP addresses on a given network, and be on
multiple networks with multiple interfaces)
you could try and rely on the receiving system being rsyslog and the heuristics
that it uses if the sending system doesn't properly set the hostname field, but
that's an ugly, fragile way of doing things.
Really, what you need to do is to have the system that first receives the
message be the one to put in the IP, and use the fromhost-ip variable for that.
David Lang
On Thu, 17 Sep 2015, Rainer Gerhards wrote:
Date: Thu, 17 Sep 2015 09:09:02 +0200
From: Rainer Gerhards <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Rsyslog use hostname instead of IP
I think there is a fromhost-ip property that you can use. It's given
in the property doc. There is also a legacy statement along the lines
of "$omfiledefaulttemplate". In current style, I think it simply is
module(load="builtin:omfile" template="namehere")
Rainer
2015-09-17 8:58 GMT+02:00 Muhammad Asif <[email protected]>:
Thanks for sir,
Can you guid me which template can fullfil my need and how can i make it
default. I use the below templates.
$template tname,"%msg%"
$template linuxbox,"<%pri%>%timestamp% 172.20.16.15 %syslogtag%%msg%"
# Ii sender machine.
*.* @@172.20.16.5:514;tname
On Thu, Sep 17, 2015 at 11:50 AM, Rainer Gerhards <[email protected]>
wrote:
You can define a new template and set this as default template. Other
than that, your only option is to modify the source.
Rainer
2015-09-17 8:44 GMT+02:00 Muhammad Asif <[email protected]>:
Dear Guys,
My rsyslog send logs to remote server but its send hostname instead of IP
address. How can I enforce rsyslog to use IP address in logs. I can not
use
any template. I want its default behavior to use IP address.
Sep 17 11:37:53 pms sshd[8834]: Failed password for aserg from
172.20.16.51
port 62217 ssh2
Regards
Asif
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
