[syslog-ng]$HOST variable

Chris Sibbitt CSibbitt@jetnet.ca
Fri, 3 Aug 2001 13:16:18 -0400 

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_000_01C11C40.022EA2E0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C11C40.022EA2E0"


------_=_NextPart_001_01C11C40.022EA2E0
Content-Type: text/plain;
	charset="iso-8859-1"

 Greetings. I'm having a problem with getting syslog-ng to write out to
filenames based on $HOST. My setup is as follows:
 
-I have two machines running syslog-ng
-Machine A has a program that sends syslog messages to itself (127.0.0.1)
-Machine A has a tcp destination rule like: destination Machine_B{
tcp(10.1.1.1); }
-Machine B has a tcp source rule that receives the messages from Machine A 
-Machine B has a destination rule like: destination host_logs {
file("/logs/$HOST.txt"); }
 
 The problem is that what I end up with on Machine B is a file called
/logs/127.0.0.1 that contains all the messages generated by the program on
Machine A. They look like this:
 
Aug  3 09:12:48 127.0.0.1/127.0.0.1/10.1.1.2 myprog[2182]: Test message
 
 I've fiddled with setting keep_hostname() to yes and no on Machine B, but
to no avail... apparently this doesn't affect the $HOST variable. I know
that chain_hostnames(no) fixes the problem (I get a file named 10.1.1.2,
which is what I want), but I'd really like to see the whole path the message
took because sometimes Machine A will receive messages from others that get
forwarded on. Is there any way to accomplish this.
 
 In simple terms, I think I'm looking for a way to get the $HOST variable to
pick the LAST hostname in the chain instead of the first. Any ideas, or do I
need to edit the code? If the later is the case, I'm pretty sure I need to
fix something in expand_macro() (in affile.c), if anyone knows exactly how
this should be done some help would be appreciated, otherwise I'll dust off
my debugger skills and see what I can accomplish. I hope it doesn't come to
that though.
 
 
JetNet Logo
Chris Sibbitt
Operations Development
106 Schneider Road, Unit C
Kanata, Ontario K2K 1Y2
Phone (613) 271-6220, ext228
Fax     (613) 271-6229
 

------_=_NextPart_001_01C11C40.022EA2E0
Content-Type: text/html;
	charset="iso-8859-1"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">


<META content="MSHTML 5.00.2314.1000" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>&nbsp;Greetings. I'm 
having a problem with getting syslog-ng to write out to filenames based on 
$HOST. My setup is as follows:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=497434915-03082001></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>-I have two machines 
running syslog-ng</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>-Machine A has a 
program that sends syslog messages to itself (127.0.0.1)</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>-Machine A has a tcp 
destination rule like: destination Machine_B{ tcp(10.1.1.1); 
}</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>-Machine B has a tcp 
source rule that receives the messages from Machine A </SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001></SPAN></FONT><FONT 
face=Arial size=2><SPAN class=497434915-03082001>-Machine B has a destination 
rule like: destination host_logs { file("/logs/$HOST.txt"); 
}</SPAN></FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>&nbsp;The problem is 
that what I end up with on Machine B is a file called /logs/127.0.0.1 that 
contains all the messages generated by the program on Machine A. They look like 
this:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=497434915-03082001></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001></SPAN></FONT><FONT 
face=Arial size=2><SPAN class=497434915-03082001>Aug&nbsp; 3 09:12:48 
127.0.0.1/127.0.0.1/10.1.1.2 myprog[2182]: Test message</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=497434915-03082001></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>&nbsp;I've fiddled 
with setting keep_hostname() to yes and no on Machine B, but to no avail... 
apparently this doesn't affect the $HOST variable. I know that 
chain_hostnames(no) fixes the problem (I get a file named 10.1.1.2, which is 
what I want), but I'd really like to see the whole path the message took because 
sometimes Machine A will receive messages from others that get forwarded on. Is 
there any way to accomplish this.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001></SPAN></FONT><FONT 
face=Arial size=2><SPAN class=497434915-03082001></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=497434915-03082001>&nbsp;In simple 
terms, I think I'm looking for a way to get the $HOST variable to pick the LAST 
hostname in the chain instead of the first. Any ideas, or do I need to edit the 
code? If the later is the case, I'm pretty sure I need to fix something in 
expand_macro() (in affile.c), if anyone knows exactly how this should be done 
some help would be appreciated, otherwise I'll dust off my debugger skills and 
see what I can accomplish. I hope it doesn't come to that 
though.</SPAN></FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV><IMG align=baseline alt="JetNet Logo" border=0 hspace=0 
src="cid:497434915@03082001-1e10"></DIV>
<DIV><FONT face=Arial size=2>Chris Sibbitt</FONT></DIV>
<DIV><FONT face=Arial size=2>Operations Development</FONT></DIV>
<DIV><FONT face=Arial size=2>106 Schneider Road, Unit C</FONT></DIV>
<DIV><FONT face=Arial size=2>Kanata, Ontario K2K 1Y2</FONT></DIV>
<DIV><FONT face=Arial size=2>Phone (613) 271-6220, ext228</FONT></DIV>
<DIV><FONT face=Arial size=2>Fax&nbsp;&nbsp;&nbsp;&nbsp; (613) 
271-6229</FONT></DIV>
<DIV>&nbsp;</DIV></BODY></HTML>

------_=_NextPart_001_01C11C40.022EA2E0--

------_=_NextPart_000_01C11C40.022EA2E0
Content-Type: image/gif;
	name="200x40.gif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="200x40.gif"
Content-ID: <497434915@03082001-1e10>

R0lGODlhyAAnAPf/AP///wgICBAQEBgYGCEhISkpKTExMTk5OUJCQkpKSlJSUlpaWmNjY2tra3Nz
c3t7e4SEhIyMjJSUlJycnKWlpa2trbW1tb29vcbGxs7OztbW1t7e3ufn5+/v7/f39+/n5/fv7//3
987GxtbOzt7W1ufe3r21ta2lpbWtrca9vZSMjJyUlKWcnIyEhHNra4R7e2tjY1pSUmNaWlJKSkpC
QkI5OTkxMTEpKVpKSikhISEYGAgAAGtaUrWlnOfe1sa9tYR7c2NaUkI5MbWtpZyUjFpSSlJKQjkx
KUpCOe/v5///987OxtbWzt7e1ufn3r29ta2tpbW1rcbGvZSUjJyclKWlnHt7c3Nza2trY1paUmNj
WlJSSkpKQkJCOTk5MTExKSkpISEhGBgYEOfv5+/37/f/98bOxs7Wztbe1t7n3rW9ta21rb3GvYyU
jJSclJylnISMhHN7c2tza3uEe2NrY1JaUlpjWkpSSkJKQikxKSEpIRghGBAYEAAIAAAQAAAYAAAh
AAApAAAxAAA5AABKAABSAABaAABjAABrAABzAAB7AACEAACMAACUAACcAAClAACtAAC1AAC9AADG
AADOAADWAADeAO/39/f//5ylpYSMjCkxMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAAyAAnAEAI/wABCBxI
sKDBgwM9MEGhiYERLwQGSBxQwMuCOBMyeEDIsaPHjyBDihxJsmTJCQE4qVzJsuUVHilVBnpUqZKl
mpRq1nwUiOUDkUZatvwp0IHQoyohACDRB6lTTkYEQjg6oANBDwRYShCIJuZTlQQELvh6NACaklmd
Kj2IQGUhS5TiUhpE9hDcuJP+qEww0kLLtQCMkuUE2KAHr5wCbDz4gGVUNS1bAEirciuAroMJLD5I
p2UGkwffCLXM0cRKR5XkVir0VJDcnIxWFv7olyVgwSsneNjNmzfHwywVI5y6MirBDUgtYy7eu/lm
g51ZfgZNHWEJPC37DDKEKJEhQU1ZIv8IiYYs34FYCgzYikBLAQBjCNQhkIFMAjENANgRw2AMhxoM
bHVFAFwkccEAFQBQAwFVKABACgQ4AAMmA3XBAAEkcNBFAwZ4kIYATRxwgYIMFPAcGAYIdEAdWDhx
gQEOXBBCAAZQoYQceXChARM2NJBgdSJZcMBggwVQxwNy0NFAFl0YEFMBSwAp5ZRUVlmdC2RhSFAL
K9n1WmqOGDKIIIbQlJpqhKyEAUm1yTYQbipRUFIHiAl3EHFIjQgAVlpxhZhxJEW30nTVUYBUWBxx
ENMiZ1ayCJGJNKoIWM951KZKRAXW0o8jAbeSnQbhCdVATzylHGIzmCSoSoRaSQYcA3D/AoVHEqz0
xyRnqqbTa3IJspIDJVUw1EByEMlJpgV1IFSlAzW2EhIHeRBrn5cZOwCzAjHgmZXcdpuQt+CGK251
HExhA2LGlkWDGuO26+67H7FRQLpOhdeSAJwaVMZBQTmVKZxf/UQCuoOlCoCoKgnwQUF8rnQqkYiO
Ra9Z1bVF1g5WhADAB14xchevIFNiyaMr6ekRbx14IKxtb7bkQAUUwBwzBTRrsCfMMleAUnAT4Ezz
mgA4K9QAGgvUcGV+svRFzjTLbIJAS9A8cwXY2eZzzFaRpAFZyAo0hgAqGZKrJY081cjYJMva17BF
taQABA9AALfcDwAdbZ3YHsxSEFds/3s0Jw+vlEPcc89NGmfbAolwSxwgNMaijcY2GKNxWYIIpUH+
1XJwAXTueeezXYX3cI4JxEJLcxhA7XKffu55hxytykmr1AlNLUfzcoJIrpLY69QguVZCFyfjZc5y
2yzJSZKnKoFakO2AApABwUhf9qeqiVOZAWUCZM2Rtio18rHIjgASXh+CMJKryGnPwSbbmhLZdUKj
31m6QTeMlvRg1yIkO+3wIkgJKOOHR+QkZDmpBCP0AhaQeE8gGQAbS94QwApasFtJwIIEkRIABzRO
JOVxSgJAUBAtEGBEHlDAFhDgARQIIAMIqAIAhnAAgazQZhWwwQbOAoACjIgDB9gAAP+E4AIBjCcC
MtDCAAqCgEsAQA1e2IACUtABAVigAGuqQRC0sBkqSEQpGKjC7DYghRoAixNTKIFA6LAmJ0ihCHG4
oBznSMc6UsdFE4DAfeglgAVEAAVCtKMgB1kSDbyBAdSjF1IQUAElEPKRkFTZHRT5FS9Q4YF7YsIE
HOACTApEAxgIpShFeYEPAoADFxilKlXZOA+s8pWrJIFAUKlKmxkkA6P8oCthucrpgJKXvMwbSTbQ
NyIRTBCFSIQjIMFMRRSiJ59SXkj6hZTbGMt9JKCkcWyXG4ZRBnACaYKxNAMAidGLh6DpwOIO1QAz
VCAmfTDEARGYk0kgIjwBiEJIYiD/gAAIoJ+aQ95gBKZNqSDFClfJXfVY9xVyKoCS6CTJJczplAAo
wJYeSMBKdscrnCSwo4lYCQ1KcgH4ASxfItkgJwTAkXViKiEKBaf1WIIDkxSLJYGUkhvIsgVbDsRi
fYDE+h7BmpYMQqivkQQgVFI8kZT0ePFbiQVK4gGVdg8htrvBtPZitJgGTiVFwN6nAGiSCDwlAJIx
yApU4odI5CoSS3VKW1XjiJXkx6kBjepXgIWQKrLkqvZbSRFKsFVOdGEjXt3fVwQgzP9JiQ1PcVC0
0sLRuEBiMH+QhGoMoZIU4dUnm+MaR/y6EsCG6n55YEmHEjvTLDU2OGQliVmRMoVE/8VEfXFxFJG8
lBOS9S8kT3WTQCvjHw4U1z/CJG3CPCkQ6A0kBpxbHWKQYNzqVncMHXEskDrwzZXMjyB0Uoki7lKJ
ug4GqTnhLCfAIEyDBDcpoY3TnKzKXL0VZyCY6IJTvjqqkqwqALEdpkpVwgKPNEAlgPjSpL6C27hE
YiULGMl7jxVfTqDUgfQl3X0J8oLkKLa/gcqelNSgUhicTA8InsRrJnEIpCACV2hKmBMknFeACWAi
OB6AACLQ1wwz5n4E4eZC0ZVjHNfQf7DlFgcmkDvJcoQJEgQETb40iUg84hGQmGduIREeAtSXIxO2
JpFCJxDlJqa+ooreQKCgPwAgh/9IJkKydMLVgQtUYMYdocFKBDFleuZWEtDkxAK+zJE5tITHAsGA
BBbN6EY7OsATaLRuEJKBRj/tIEtwtC074OhON/oEHFF0oxdmRyCyRBCKiEQCcRIJRAxPJXhgwkfQ
sAcvKIABMkAAwXyagQnoyQQSmM4GWoBCCkxgAtI7tlWaAIERAIBmE+iABoINAClgoAMiEMgFICDr
gZggBFFogpshsCYPWMADT7CKBSSQ00SnoMwRKDAAUDAHIepsRMeeQOMsAIF225EC+ePfBMhAnkSq
JAYPbEAeCEAFACQgC6mSwBIdIJkfnMcOBWgDANrQVAAcYDoL2IgRDGCDCEMgAiuxQNYFAvAEAExg
PFagQAf4sAERKSgLDdhMBkqehqBxoQEd2AACZICBwyiAXQCIwxkAUII7yMBkj/zAuh3ABQMcwAgO
iMATTCkSdTKgSQQoQA20IIFuF8QCJquABzJh7xZIYCMkUJ4FNCEBq1QADnrSt/QgwAYAVAGXcupA
BCYgzZstZt3IBkAFUL6RBE3ApxfQQAbkxIJMyEkDE3CDECMQAX0+sXElYMHjIUn60pteIAEBADs=

------_=_NextPart_000_01C11C40.022EA2E0--