<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
FYI<br><br>I've modified Snares config to not enable syslog headers, and now my logs are going into a newly created directory, same as all others. The only difference now is that the hostname/domainname used before is not the same as what was previously being used. The former was dictated by the logs entry, the new one uses DNS to resolve.<br><br>.vp<br><br><blockquote><hr>From: wiskbroom@hotmail.com<br>To: syslog-ng@lists.balabit.hu<br>Date: Tue, 13 May 2008 10:48:31 -0400<br>Subject: [syslog-ng] Irregular Behaviour With Snare Agent (syslog-ng or Snare?)<br><br>
<meta http-equiv="Content-Type" content="text/html; charset=unicode">
<meta name="Generator" content="Microsoft SafeHTML">
<style>
.ExternalClass .EC_hmmessage P
{padding:0px;}
.ExternalClass body.EC_hmmessage
{font-size:10pt;font-family:Tahoma;}
</style>
Greetings;<br><br>I currently have syslog-ng.conf set up to place data into logs in the following way:<br><br>/var/log/MyHosts/SambaServers/$FULLHOST.log<br><br>When the logs are created, they are placed under:<br><br>/var/log/MyHosts/SambaServers/samba-1.mynet.org/samba-1.mynet.org.log<br><br>The contents for the hostname field in logs from samba-1 look like this:<br><br>May 13 10:32:55 samba-1.mynet.org/samba-1.mynet.org<br><br>Because of the double entry in syslog, all looks fine and logs are stored in nice neat folders named after the host that sent them, great.<br><br>I have however a few MS Wintel servers that I am using Snare for sending syslog data to, and their logs look like:<br><br>May 13 10:36:15 samba-2.mynet.org MSWinEventLog 1 Security<br><br>As you can see, the logs from this host do not contain the hostname twice, therefore logs for this host are stored as:<br><br>/var/log/MyHosts/SambaServers/samba-2.mynet.org.log<br><br>I can create a rule like /var/log/MyHosts/SambaServers/$FULLHOST/$FULLHOST.log for just these hosts, but that will not solve my problem long term, especially as I am considering implementing Snare site-wide.<br><br>Could someone please advise as to whether there is an easy fix for this, or should I cease using Snare?<br><br>Thanks in advance,<br><br>.vp<br><br><br>
</blockquote></body>
</html>