Issues with lowercase hostname on 3.2.5
Hello, I'm running syslog-ng 3.2.5 from EPEL on RHEL and having an issue with the $HOST variable. My destination is destination device_log { file("/<snipped>/$HOST.log"); }; and that is working, except the file is created with an uppercase name if the host reports it that way. I'd like them to all be consistently lowercase. I can't use a DNS look up instead since not all of the hosts have reverse DNS set for their IPs. I've tried normalize-hostnames(yes); in the global options but it doesn't seem to make a difference. Also I don't believe $(lowercase ...) is available to me in 3.2.5. I've read through the documentation and have come up empty. What am I missing? Apologies if this has been asked before; I searched the list but couldn't find anything. Thanks for any pointers, Kay Avila
Hi, No promises, but I'd definitely try `subst()` with a regexp and `\L` which is supposed to lowercase Cheers
Hi, "Kay N. Avila" <kaynavila@gmail.com> írta 2015-09-23 11:26-kor:
I've read through the documentation and have come up empty. What am I missing? Apologies if this has been asked before; I searched the list but couldn't find anything.
My best practice for host value, is to use a static hosts file: In that case you do not have to keep another dns cache in memory, you have control locally and do not depend on an udp based service where you can loose request/reply, etc. So, I suggest to use: keep-hostname(no); use-dns(persist-only); dns-cache-hosts(/my/local/hosts.file); Kind regards, György Pásztor
Thanks for the suggestions. Fabien, would you recommend that in a rewrite statement? I'm new to syslog-ng so it's taking me a bit but I'm still playing around with it. György, thanks for the suggestion. We've got hundreds of hosts so maintaining a local file would be a bit of a challenge. Are there any known issues with the EPEL package and normalizing host names? I'm using this option correctly, right? options { ... normalize_hostnames(yes); }; Thanks again, Kay Avila On Thu, Sep 24, 2015 at 10:13 AM, PÁSZTOR György <pasztor@linux.gyakg.u-szeged.hu> wrote:
Hi,
"Kay N. Avila" <kaynavila@gmail.com> írta 2015-09-23 11:26-kor:
I've read through the documentation and have come up empty. What am I missing? Apologies if this has been asked before; I searched the list but couldn't find anything.
My best practice for host value, is to use a static hosts file: In that case you do not have to keep another dns cache in memory, you have control locally and do not depend on an udp based service where you can loose request/reply, etc.
So, I suggest to use: keep-hostname(no); use-dns(persist-only); dns-cache-hosts(/my/local/hosts.file);
Kind regards, György Pásztor ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi Kay, On Fri, Sep 25, 2015 at 09:29:16AM -0500, Kay N. Avila wrote:
Thanks for the suggestions. Fabien, would you recommend that in a rewrite statement? I'm new to syslog-ng so it's taking me a bit but
Yes, That's what I was suggesting. Unfortunately '\L' and '\U' are only available in replacement context (s/./\L&/) so my initial suggestion won't help here. I can only suggest upgrading syslog-ng :-/
participants (3)
-
Fabien Wernli
-
Kay N. Avila
-
PÁSZTOR György