On Mon, Sep 8, 2008 at 8:40 AM, <wiskbroom@hotmail.com> wrote:
This worked indeed! Thank you. Is there any other way to achieve this? While this fixes this problem, it breaks other functionality I have in place, i.e. my logrotate scripts and some other SEC rules.
Thanks!
No problem. I'd see about turning long_hostnames back on - then overriding the setting with a macro in a template, using something like $HOST_FROM or one of those. I'm sure you can find one that doesn't have the chained names in it. At that point, you just have the graphing scripts look at the templatized graphs. Feed the long hostnames (non-templatized logs) to SEC, and it should be happy. The only thing I can't speak to is your logrotate settings, since I don't know what it needs.