<div><br></div><div class="gmail_quote">On Fri, Jul 23, 2010 at 11:06 AM, lecalcot <span dir="ltr"><<a href="mailto:lecalcot@cisco.com">lecalcot@cisco.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<font face="Calibri, Verdana, Helvetica, Arial"><span style="font-size:10pt">Hi,<br>
<br>
I’m wondering if syslog-ng is capable of rewriting the hostname field in the header of syslogs as they are forwarded to a remote loghost. Is this possible?<br>
<br>
Thanks,<br>
Lee</span></font>
<br><div class="im"><br></div></div></blockquote></div><div><br></div><div>There are a couple ways to do this. If you want all messages in a certain log statement to be replaced with specific text, you can just use a rewrite rule on the HOST macro:<div>
<br></div><div>rewrite r_replacename { set("whatever-you-want", value("HOST")); };</div><div><br></div><div>You can also use subst() rather than set() to match/replace only certain parts & use regex. Check out page 88 of the 3.1 OSE syslog-ng admin guide.</div>
<div><br></div><div>If you need help replacing hostname on the fly, with perhaps something else that exists in the message body, using the parser {} function (paired with patterndb, what all the cool kids are using now) to generate your own macros, then use rewrite{} with that is your best bet.</div>
</div><div><br></div><br>-- <br>Lance Laursen<br>Demonware Systems Engineer<br>