Since starting this thread, I've gotten Snare to work.. It's very nice
since I can decide what type of message (Informational, Error, etc) I
want to get sent. It is also open source and actively being worked on.<br>
<br>To answer your question, I'm not seeing the hostnames because the machines are not on the same network.. See the message below which I posted yesterday with a different topic.<br><br>---------------------------------------------------------------------------------------------
<br>I have some machines behind a firewall VLAN of <a href="http://10.0.240.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.240.0</a> sending logs to a Linux Syslog server on the <a href="http://10.0.230.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.0.230.0</a> network.<br>The 2 machines are <a href="http://10.0.240.71/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.0.240.71</a> and <a href="http://10.0.240.72/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.240.72</a> and the Syslog server is <a href="http://10.0.230.222/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.0.230.222</a>.<br>They are Windows and I am using the Eventlog to Syslog utility from Purdue University (
<a href="https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys</a>) to convert the Windows event logs to Syslog.
<br><br>Syslog is getting the information, however, any information from the 2 machines are coming in as
<a href="http://10.0.230.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.230.1</a>.<br>-------<br>Sep 28 11:37:54 <a href="http://10.0.230.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.0.230.1</a> Service Control ....... <---- This machine is actually <a href="http://10.0.240.71/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.240.71</a><br>---------------------------------------------------------------------------------------------
<br><br><br><div><span class="gmail_quote">On 9/29/06, <b class="gmail_sendername">SOLIS, ALEX</b> <<a href="mailto:asolis@oppd.com">asolis@oppd.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">What do you mean by not sending the
hostname? I use ntsyslog and syslog-ng knows what host the log event is coming
from. I am not sure if syslog-ng is doing the work or ntsyslog but it works
for me.</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Just curious as to why you didn't see
hostnames???</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<div>
<div style="text-align: center;" align="center"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">
<hr align="center" size="2" width="100%">
</span></font></div>
<p><b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold;">From:</span></font></b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;">
<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
syslog-ng-bounces@lists.balabit.hu</a>] <b><span style="font-weight: bold;">On Behalf Of </span></b>Tom Valdes<br>
<b><span style="font-weight: bold;">Sent:</span></b> Friday, September 29, 2006
12:06 PM<span class="q"><br>
<b><span style="font-weight: bold;">To:</span></b> Syslog-ng users' and
developers' mailing list<br>
<b><span style="font-weight: bold;">Subject:</span></b> [syslog-ng] EventViewer
to SysLog - looking for opinions</span></span></font></p>
</div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p><div><span class="e" id="q_10dfb04d5ddca5b0_3">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">I recently started evaluating tools to convert Windows Event Viewer
messages to SysLog and I'm looking for opinions on the different ones and what
to look for.<br>
<br>
I first started with EvtSys and it worked pretty well but it left out the
hostname so it was hard to make server specific swatch statements. <br>
I then tried </span></font><font size="2"><span style="font-size: 10pt;">ntsyslog
which shared the same problem.<br>
<br>
I'm now trying Snare (thanks Kevin for the tip) and it looks a lot more
flexible as to what type of events get sent and it sends the hostname as well.
When I first installed it, it worked fine and send messages.. After fiddling
with it, it stopped working correctly. I'm going to start working with it
again, but I'd like to here what else people are using. <br>
<br>
The 2 things the tool should have are:<br>
be free and transmit the Hostname.<br>
<br>
thanks,<br>
tom</span></font></p>
</span></div></div>
<br><br><table style="color: black;" bgcolor="white"><tbody><tr><td><br><br>
This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
<br>
</td></tr></tbody></table></div>
<br>_______________________________________________<br>syslog-ng maillist - <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a onclick="return top.js.OpenExtLink(window,event,this)" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html
</a><br><br><br><br></blockquote></div><br>