You want to use something other than %HOSTNAME%, see the list of properties available at <http://www.rsyslog.com/doc/v8-stable/configuration/properties.html>.

You might also want to set the hostname on the Cisco switch, search for cisco ios set hostname with your favourite search engine.


BR,
- Simon

On Fri, 2018-02-16 at 16:56:12 -0500, John Ratliff wrote:
When my rsyslog server receives packets from our cisco switches, instead of logging it with the hostname, it logs it with the IP address. How can I get rsyslog to use the hostname instead?

This is my rsyslog.conf file.

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog

template(name="RemoteLogTemplate"
        type="string"

string="/var/log/remote/%HOSTNAME%/%$year%/%syslogfacility-text%-%$year%%$month%%$day%.log")

ruleset(name="remote") {
       *.*     -?RemoteLogTemplate
}

# provides UDP syslog reception
module(load="imudp")
input(type="imudp"
       port="514"
       ruleset="remote")

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
*.=debug;\
       auth,authpriv.none;\
       news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
       auth,authpriv.none;\
       cron,daemon.none;\
       mail,news.none          -/var/log/messages
*.emerg                         :omusrmsg:*

Thanks.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to