<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
{font-family:"\@MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1307781613;
mso-list-type:hybrid;
mso-list-template-ids:1786312080 -1767356478 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:\F06E;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:"MS Mincho";
mso-bidi-font-family:Arial;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We have a bunch of servers whose applications write error/debug
messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward
the messages to a central logging server which also forwards the messages to
zenoss running on the central logger server. The problem with our configuration
(which I have copied here) is that no matter which server originates the
message, they show up on the central server as originating from localhost –
in both zenoss and in the /var/log files We want them to be shown as
originating from the server that produced the messages. We can add a template
on the central logger to log the messages as coming form $FROM_HOST, but while
that solves the problem for the /var/log messages, zenoss still shows the
messages as coming from localhost. Please help, we are new to using
syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-----------------server syslog-ng.conf (slightly
abbreviated)<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>options {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>use_dns(yes);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>use_fqdn(no);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>chain_hostnames(no);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>keep_hostnames(yes);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>:::<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>source java {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>udp(ip(127.0.0.1) port(514));<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>destination remote {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>udp(“192.168.99.105”
port(514));<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>log { source(java);
destination(remote); };<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>------------------central logger
config file<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>options {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
use_time_recvd( no );<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
time_reopen(1);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
long_hostnames(off);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
sync(0);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'> use_dns(yes);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
use_fqdn(no);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
chain_hostnames(no);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
keep_hostname(yes);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
create_dirs(yes);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
stats(3600);<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>source src {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
unix-stream("/dev/log");<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
pipe("/proc/kmsg");<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
internal();<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
udp(ip(0.0.0.0) port(514));<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>destination everything {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
file("/var/log/$HOST_FROM.$MONTH$DAY$YEAR" template("$HOST_FROM
$HOUR:$MIN:$SEC $MSG\n"));<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>destination zenoss {<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
udp( "localhost" port(5514) );<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>
#udp( "localhost" port(5514) template("<$PRI>$DATE
$HOST_FROM $MSG\n") );<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>};<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>log { source(src);
destination(everything); };<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>log { source(src);
destination(zenoss); };<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
</div>
<br>PLEASE READ: This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please delete it and all copies from your system, destroy any hard copies and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Nomura Holding America Inc., Nomura Securities International, Inc, and their respective subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state the views of such entity. Unless otherwise stated, any pricing information in this message is indicative only, is subject to change and does not constitute an offer to deal at any price quoted. Any reference to the terms of executed transactions should be treated as preliminary only and subject to our formal written confirmation.
</body>
</html>