[syslog-ng]chain_hostname(yes) complicates use of $HOST variable

[John A. Parker]

--=====================_513843224==_.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed

Baszi,

I've noticed that chain_hostname and chain_hostnames have been used 
interchangeably in some of our communications. (Singular in your last note, 
plural in the manual.) Without a reference to keep_hostname in the manual, 
I somehow made the option plural in the syslog-ng.conf file. When I changed 
it to singular the parse error went away and the logs started looking like 
you've described below. Thanks for the extra detail.

However, I guess I'm still not sure how "server" becomes "src@", "Message", 
or "last" on my server? Messages like
"Sep 18 10:38:04 Message forwarded from hostname:" where the hostname is 
the system short name and the field typically populated by a FQDN now have 
Message. Have I something configured incorrectly?

>So if you have a message which has hostname "server", and which resolves to
>"server2", the following happens:
>
>                                 keep_hostname(yes)      keep_hostname(no)
>chain_hostname(yes)     server                  server/server2
>chain_hostname(no)              server                  server2


---

John A. Parker        Senior Programmer/Analyst - AIX      Cornell University
jap54@cornell.edu   607-255-9356  607-255-8521 (Fax) 
--=====================_513843224==_.ALT
Content-Type: text/html; charset="us-ascii"

Baszi,


I've noticed that chain_hostname and chain_hostnames have been
used interchangeably in some of our communications. (Singular in your
last note, plural in the manual.) Without a reference  to keep_hostname
in the manual, I somehow made the option plural in the syslog-ng.conf
file. When I changed it to singular the parse error went away and the
logs started looking like you've described below. Thanks for the extra
detail.


However, I guess I'm still not sure how "server" becomes
"src@", "Message", or "last" on my server?
Messages like

"Sep 18 10:38:04 Message forwarded from hostname:" where
the hostname is the system short name and the field typically
populated by a FQDN now have Message. Have I something configured
incorrectly?


> So if you have a message which has hostname
> "server", and which resolves to 
> "server2", the following happens:
>
>         
>         
>         
>         
> keep_hostname(yes)
>       
> keep_hostname(no)
> chain_hostname(yes)
>      
> server
>   
>         
>         
> server/server2
> chain_hostname(no)
>       
>         
> server
>   
>         
>         
> server2



---


John A. Parker        Senior
Programmer/Analyst - AIX      Cornell
University

jap54@cornell.edu   607-255-9356  607-255-8521 (Fax)

--=====================_513843224==_.ALT--