On Wed, Mar 21, 2018 at 9:58 AM, Fabien Wernli <wernli@in2p3.fr> wrote:
On Wed, Mar 21, 2018 at 09:46:32AM -0400, Asif Iqbal wrote:
> My client hostname is svl-search-01 and its IP resolves to svl-remote-01.
> Its syslogs do not have any PRI or hostname in HOST field.
>
> I like to have svl-search-01 in the HOST field.

In that case the only sensible options are:

* upgrade & use add-contextual-dat

  or

* use /etc/hosts and keep-hostname(no)


I noticed if I have mutiple source files I only get logs from the last source only. Does that make sense?

source s_sys {
        file ("/proc/kmsg" program_override("kernel: "));
    system();
    internal();
    udp(ip(0.0.0.0) port(514));
};

source s_udp { udp(ip(0.0.0.0) port(514)); };

source s_alarm { udp( ip(0.0.0.0)  port(514) use_dns(persist_only) ); };

log { source(s_sys); filter(f_ciena); destination(d_ciena); };
log { source(s_alarm); filter(f_alarm); destination(d_alarm); };

As soon as I commented all the other sources and only kept the s_sys, I started getting logs again from
those routers.





______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq





--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?