LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 01-19-2014, 04:42 AM   #1
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Servers: Debian Squeeze and Wheezy. Desktop: Slackware64 14.0. Netbook: Slackware 13.37
Posts: 8,551
Blog Entries: 28

Rep: Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176
rsyslog: re-write hostname in locally-generated messages?


Our hostnames are only unique when the first two parts of the FQDN are used. For example: server.london.example.com and server.mumbai.example.com.

Messages in /var/log/syslog look for example like:
Code:
Jan 19 15:02:04 server postfix/qmgr[5378]: 6BBD62D6059: removed
Can rsyslog be configured to change server in the above message to server.mumbai?

Research suggested the PropertyReplacer could do that. The preamble on http://www.rsyslog.com/doc/property_replacer.html says "A syslog message has a number of well-defined properties (see below). Each of this properties can be accessed and manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.".

Encouraging; maybe ...
Code:
%fromhost-ip:::127.0.0.1:<something>
... but I could not identify the right <something>. The rsyslog documentation at http://www.rsyslog.com/doc/property_replacer.html, in the section on Property Options, gives Name as a possible option and says it is a "template / property / constant". The "constant" looks promising but what is it? No further documentation or usage examples about "constant" found.

Maybe rsyslog can't assign a value to a property. David Lang (who appears often on the Internet, giving apparently sound advice about rsyslog) says exactly that at http://www.gossamer-threads.com/list...sers/6221#6221.

Hmm ... ?
 
Old 01-20-2014, 05:04 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,485
Blog Entries: 54

Rep: Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902
Not what you asked for but (until you find your solution) how about setting a per server output template, say:
Code:
$template london,"/var/log/server.london.example.com.log"
and use that as a filter:
Code:
if ($fromhost-ip == "1.2.3.4") \
 then -?london
 & ~
If that's not what you want then the rsyslog users mailing list may be of help?
Would be interesting to know the "right" solution...
 
Old 01-21-2014, 09:39 PM   #3
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Servers: Debian Squeeze and Wheezy. Desktop: Slackware64 14.0. Netbook: Slackware 13.37
Posts: 8,551
Blog Entries: 28

Original Poster
Rep: Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176
Thanks unSpawn

Good workaround suggestion but not applicable in our situation -- each server only logs its own messages; the change of hostname is desired for clarity when we paste log messages into issue reports.

I have asked in the rsyslog mailing list and will update this thread with information from there.
 
Old 01-23-2014, 12:31 AM   #4
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Servers: Debian Squeeze and Wheezy. Desktop: Slackware64 14.0. Netbook: Slackware 13.37
Posts: 8,551
Blog Entries: 28

Original Poster
Rep: Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176Reputation: 1176
Solved

David Lang replied very promptly on the rsyslog mailing list:
Quote:
You cannot change one of the default properties, with v7 you can create and use your own variables, but in this case, that's not what you are really needing.

Instead of trying to change one of the existing properties, the thing to do is to create a new template instead of using one of the defaults. Then in place of the %hostname% field you can put whatever you want.
Given that pointer -- and after realising that -c4 made our rsyslogd version 6.4 behave in version 4 compatibility mode so list templates were not an option -- it was straightforward.

The solution was to create this /etc/rsyslog.d/FileFormat.template.conf file ...
Code:
$template FileFormat,"%timegenerated% server.london %syslogtag%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate FileFormat
... and restart rsyslogd.

In case it matters, this was on Debian 6 squeeze where /etc/rsyslog.conf has:
Code:
$IncludeConfig /etc/rsyslog.d/*.conf
 
1 members found this post helpful.
Old 01-23-2014, 01:56 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,485
Blog Entries: 54

Rep: Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902Reputation: 2902
Well done. Thanks for posting the solution!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is it possible to filter messages in rsyslog? ust Linux - Newbie 3 10-02-2013 04:21 AM
Rsyslog + Openssl generated certificates Mirage42 Linux - Software 0 12-31-2010 03:11 AM
Routing Locally Generated Packets dklucas Linux - Networking 2 08-11-2010 02:05 AM
[SOLVED] Iptables: how to redirect locally-generated packets to a remote server? briwood Linux - Networking 27 03-24-2010 10:20 AM
after hostname change, syslogd still output previous hostname to messages file tiger2000 Linux - General 3 07-22-2009 09:36 PM


All times are GMT -5. The time now is 07:43 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration