Hi,
I have a strange behaviour with from-host.
The fromhost is stored in a variable
set $!myhost=$fromhost;
A template is used to rewrite the message by forcing the hostname :
template (name="forcedhostf" type="list" ) {
constant(value="<")
property(name="pri")
constant(value=">")
property(name="timestamp" dateFormat="rfc3339")
constant(value=" ")
#property(name="fromhost-ip")
property(name="$!myhost")
constant(value=" ")
property(name="syslogtag" position.from="1" position.to="32")
property(name="msg" spifno1stsp="on" )
property(name="msg")
constant(value="\n")
}
For one source I have one connection for the impstats and one for the regular
messages (two rulesets on the sender)
For some senders but not all, at the same time I have either the hostname or
the ip address of the sender.
Both the ip address and the hostname are correctly resolved by the dns.
What could be the cause of this behavior ?
Could the number of connected sender be an issue ?
How can I ensure to have the hostname of the sender ?
The ultimate goal is to store the message by sender.
If you have another way (without relying on the name in the message which can
be corrupted) to do that I would gladly test it.
Best regards
Philippe
equensWorldline is a registered trade mark and trading name owned by the
Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for
the addressee. If you receive this e-mail in error, you are not authorized to
copy, disclose, use or retain it. Please notify the sender immediately and
delete this email from your systems. As emails may be intercepted, amended or
lost, they are not secure. EquensWorldline and the Worldline Group therefore
can accept no liability for any errors or their content. Although
equensWorldline and the Worldline Group endeavours to maintain a virus-free
network, we do not warrant that this transmission is virus-free and can accept
no liability for any damages resulting from any virus transmitted. The risks
are deemed to be accepted by everyone who communicates with equensWorldline and
the Worldline Group by email
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
