2016-12-23 14:02 GMT+01:00 Swartz, Patrick <[email protected]>:
> Hi David, > Thanks for helping me understand. > Something like this is what I 'thought' I wanted: > > Module ( > load="omudpspoof" > ) > Template ( > name="spoofaddr" > type="string" > string="%HOSTNAME%" <--- to be pulled from the message instead of I think I see what you mean. I also think this must be an ip address. Assuming that the system you received the message from should be used by omudpspoof, %fromhost-ip% should be what you are looking for. Rainer > hardcoded to a specific address. > ) > Action ( > type="omudpspoof" > target="192.168.1.1" > sourcetemplate="spoofaddr" > ) > > I understand that the above doesn't work that way, but that line of > thinking is where I thought I wanted to go. > > Thanks again for your patience. > > Patrick > > -----Original Message----- > From: rsyslog [mailto:[email protected]] On Behalf Of > David Lang > Sent: Thursday, December 22, 2016 10:57 PM > To: rsyslog-users <[email protected]> > Subject: Re: [rsyslog] collect and forward w/o change > > On Fri, 23 Dec 2016, Swartz, Patrick wrote: > > > Remember when I said I was still a novice ... well... > > I think I understand my mistake... > > > > From the debug: > > > > FROMHOST: 'whqlrsyslog01.mycompany.com', > fromhost-ip:'10.20.12.52', > > HOSTNAME: 'sftplprod01', PRI: 38, > > > > The server "whqlrsyslog01" is the rsyslog box that is forwarding, > whereas "sftplprod01" is the original source. > > > > So, guess my question is more... is there a way I can setup the > "FROMHOST" to use the "HOSTNAME" dynamically on the forward? > > FROMHOST and HOSTNAME have meaning on the local system, when you send a > message, you send a string that can be formatted any way you want it to. > But if you send messages through a relay, the thing receiving the message > from the relay will see the fromhost/fromhost-ip as being the relay (as it > should be, because that's where the network packets were sent from) > > omudpspoof was created to deal with badly written proprietary software > that doesn't know how to deal with messages sent through a relay. It is > slow and is abusing the network to function, but can sometimes be the right > thing to do. > > If you need it, the documentation page shows how to use it. > > http://www.rsyslog.com/doc/v8-stable/configuration/modules/omudpspoof.html > > It's still not clear what you are trying to do. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > > ---------------------------------------------------------------------- > This email and any files transmitted with it are confidential and intended > solely for the use of the addressee. If you are not the intended addressee, > then you have received this email in error and any use, dissemination, > forwarding, printing, or copying of this email is strictly prohibited. > Please notify us immediately of your unintended receipt by reply and then > delete this email and your reply. Tyson Foods, Inc. and its subsidiaries > and affiliates will not be held liable to any person resulting from the > unintended or unauthorized use of any information contained in this email > or as a result of any additions or deletions of information originally > contained in this email. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
