Good morning,
Thank you for your help so far.
I just wanted to add one more piece of data, on my other host
(compiled
in
the same way from the same source in the same BuildRoot manner, but
on
a
different platform), I get what I would expect:
Debug line with all properties:
FROMHOST: 'nios2', fromhost-ip: '127.0.0.1', HOSTNAME: 'nios2', PRI:
46,
syslogtag 'rsyslogd:', programname: 'rsyslogd', APP-NAME:
'rsyslogd',
PROCID: '-', MSGID: '-',
TIMESTAMP: 'Oct 6 12:27:44', STRUCTURED-DATA: '-',
msg: ' [origin software="rsyslogd" swVersion="8.2010.0" x-pid="1780"
x-info="https://www.rsyslog.com";] start'
escaped msg: ' [origin software="rsyslogd" swVersion="8.2010.0"
x-pid="1780" x-info="https://www.rsyslog.com";] start'
inputname: imuxsock rawmsg: '<46>Oct 6 12:27:44 rsyslogd: [origin
software="rsyslogd" swVersion="8.2010.0" x-pid="1780"
x-info="https://www.rsyslog.com";] start'
$!:
$.:
$/:
So ... FROMHOST and HOSTNAME are clearly correct here. So I guess my
question is, what APIs are rsyslogd using to try to obtain this
information? I can certainly compile additional test code and run it
if
necessary. I just find it odd that the *host* knows its name but
rsyslogd
can't figure it out?
Actually, looking a little closer, I noticed that I'm using uclibc on
the
arm platform (the broken one), but glibc on the nios2. I wonder if
this
is the issue?
-derek
On Tue, October 5, 2021 9:13 pm, Derek Atkins via rsyslog wrote:
As I said in my OP:
# hostname
arm-host
and from this query:
# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 arm-host
However, as I also stated in my OP, I another another machine on a
nios2
with the exact same configuration and there the log messages say the
correct hostname.
-derek
On Tue, October 5, 2021 8:52 pm, David Lang wrote:
what is in /etc/hosts and what do you get if you run the command
hostname?
rsyslog gets fromhost by doing a name lookup of the fromhost-ip
the log message you received (as seen by the rawmsg: section) does
not
provide a
hostname (which could have been the problem)
so based on this, the problem is with name resolution, which should
start
with
/etc/hosts and hostname
David Lang
On Tue, 5 Oct 2021, Derek Atkins wrote:
Date: Tue, 5 Oct 2021 20:28:34 -0400
From: Derek Atkins <[email protected]>
To: David Lang <[email protected]>
Cc: [email protected]
Subject: Re: [rsyslog] RSyslog thinks my machine's hostname is
"127.0.0.1"?
Hi,
Thank you for the quick response.
The logging here is all done locally, and the issue is in EVERY
log
message. The source is local (a call to vsyslog() in an
application),
or
even just a call to "logger". Here is the resulting log message
from
rsyslogd starting up:
Debug line with all properties:
FROMHOST: '127', fromhost-ip: '127.0.0.1', HOSTNAME: '127', PRI:
46,
syslogtag 'syslog:', programname: 'syslog', APP-NAME: 'syslog',
PROCID:
'-', MSGID: '-',
TIMESTAMP: 'Oct 6 00:14:18', STRUCTURED-DATA: '-',
msg: ' [origin software="rsyslogd" swVersion="8.2010.0"
x-pid="17368"
x-info="https://www.rsyslog.com";] start'
escaped msg: ' [origin software="rsyslogd" swVersion="8.2010.0"
x-pid="17368" x-info="https://www.rsyslog.com";] start'
inputname: imuxsock rawmsg: '<46>Oct 6 00:14:18 syslog: [origin
software="rsyslogd" swVersion="8.2010.0" x-pid="17368"
x-info="https://www.rsyslog.com";] start'
$!:
$.:
$/:
So... no clue where "FROMHOST" or "HOSTNAME" are coming from here,
but
my
guess that's the problem?
I can run the same config on the nios2 if you want to see what it
says,
but my guess is that FROMHOST and HOSTNAME are going to both be
"nios2"
instead of "127".
The contents of /etc/hosts is effectively the same on both
machines
(the
one that works correctly and this one).
Thanks,
-derek
On Tue, October 5, 2021 6:16 pm, David Lang wrote:
please log with the template RSYSLOG_DebugFormat so that we can
see
exactly what
rsyslog is being sent for a problem message.
David Lang
On Tue, 5 Oct 2021, Derek Atkins via rsyslog wrote:
Date: Tue, 5 Oct 2021 15:58:07 -0400
From: Derek Atkins via rsyslog <[email protected]>
To: [email protected]
Cc: Derek Atkins <[email protected]>
Subject: [rsyslog] RSyslog thinks my machine's hostname is
"127.0.0.1"?
Hi,
I'm using rsyslog in a BuildRoot environment. I've built it on
two
different platforms (nios2 and arm). The Nios2 platform works
great.
However, on the Arm platform, rsyslog seems to think the local
hostname
is
"127.0.0.1". Why do I think that? Well, /var/log/messages
contains:
Oct 5 19:34:25 127 syslog: [origin software="rsyslogd"
swVersion="8.2010.0" x-pid="8080"
x-info="https://www.rsyslog.com";]
start
Notice the "127" in there? That's where the "hostname" is
supposed
to
be.
So if for some reason it thinks the FQDN is an IP address, that
would
explain why this is doing that. But that's weird, because:
# hostname
arm-host
Moreover, if I compile and run the code to execute a
"gethostbyname()"
it
also returns "arm-host". So I have no idea where it's getting
the
idea
that the hostname/FQDN is an IP Address.
I'll note that on the Nios2 this works as expected:
Sep 30 19:28:41 nios2 rsyslogd: [origin software="rsyslogd"
swVersion="8.2010.0" x-pid="830"
x-info="https://www.rsyslog.com";]
start
I'll say this is the same version of rsyslog on both systems,
built
with
the same sources, and (ostensibly) with the same build-time, and
definitely the same run-time configurations.
I'm just at a loss for why rsyslog might be doing this, and I'm
not
sure
where else to look.
So I'm hoping you experts might be able to help me?
Thanks!
-derek
--
Derek Atkins 617-623-3745
[email protected] www.ihtfp.com
Computer and Internet Security Consultant
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
--
Derek Atkins 617-623-3745
[email protected] www.ihtfp.com
Computer and Internet Security Consultant
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
