[syslog-ng] SOLVED: Remote hosts logging as loopback, not hostname
bazsi at balabit.hu
Tue Mar 14 00:27:21 CET 2006
On Mon, 2006-03-13 at 17:26 -0500, Rob Munsch wrote:
> oh SON of a SWITCH.
> So of course, i should not be stuffing clients' info into the same
> template twice. Doesn't seem to like that. I assumed they'd have to
> match, for some reason.
> Removing the template() line from the client has allowed the info to
> appear as one would expect. Templates on client and server processes it
> twice and it doesn't like it a little bit.
> may i humbly suggest that a note about template() being advisably
> *server-only* in such an environment might be in order. of course,
> that may be obvious to most people without having to be told; i can't
> this would be the second "note to, for and by idiots" addition on nate's
> faq to come from my addled brain.
> i'm going to go get some coffee.
Oh I see, you were changing the on-wire format using a template(),
although this might be useful for custom receivers it causes problems
for a 'normal' syslog daemon (like syslog-ng is behaving when it is a
server) I'll add a note to the documentation. This is what I added, is
that making it clear?
a format conforming to the default logfile format.
Specifies a template which defines the logformat to be
used in this destination. Macros are described in <xref
linkend="macros">this section</xref>. Please note that for
network destinations it might not be appropriate to change
the template as it changes the on-wire format of the
syslog protocol which might not be tolerated by stock
syslog receivers (like syslogd or syslog-ng itself). For
network destinations make sure the receiver can cope with
the custom format that you define.
More information about the syslog-ng