On Thu, 23 Jun 2016, Maupertuis Philippe wrote:
Hi list, We have a central log server in place with logs going to files according to the sending host. The template is : $template DYNfile,"/dailylog/HOSTS/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%/%syslogfacility-text%-%$HOUR%" This works as expected for mosts clients. However some clients are probably sending malformed messages and we end up with funny hostnames like "unicast_addr_effective_port" or "ventID". So I would like to retain the hostname only if it abide by our naming convention and otherwise retain the sender's IP address.
This is a really hard thing to do, what is your naming convention?
I would also like to build a list of daily culprit to try to correct the messages on the client if possible or to set them apart. What would be the best way to do that.
are you asking the best way to build the list of culprits? or the best way to deal with them once you have the list?
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
