[syslog-ng] Upper case $HOST

[Lance Laursen]

Since you're adding a configuration option to syslog-ng.conf, you'll
need to reload the process. After you reload/restart, fresh
directories will be created. If I were you though, i would stop the
syslog-ng process, do a for loop to rename all CAPITAL-HOSTNAME
files/folders to lower-case, and then start syslog-ng again so that it
will resume logging to files where it left off.


On Thu, Nov 5, 2009 at 5:39 PM, Adam Harvey <adam at smithandtinker.com> wrote:
> Will that rename them on service reload or will it start a fresh folder
> with hostname?
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Tim Boyer
> Sent: Thursday, November 05, 2009 2:42 PM
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] Upper case $HOST
>
> Balazs Scheidler wrote:
>> On Wed, 2009-11-04 at 15:05 -0500, Tim Boyer wrote:
>>> I'm running syslog-ng 3.03 on a RHEL5 system, sending logs to various
> files
>>> like so:
>>>
>>> # global log files
>>> destination deservers {
>>>   file("/var/log/$HOST.log" owner(root) group(hobbit) perm(0640));
>>> };
>>>
>>> It's working fine on the Linux boxes.  But I'm using Adiscon's
> EventLog on
>>> my Windows machines, and the $HOST name on them are coming up in all
> caps.
>>>
>>> [root at buran log]# ls -la /var/log/*.log
>>>
>>> ...
>>> -rw-r----- 1 root hobbit 282 Nov  4 14:37 /var/log/KANTECH.log
>>> -rw-r----- 1 root hobbit 535181 Nov  4 14:24 /var/log/PLCDATA.log
>>>
>>> Where's this $HOST macro get its data from?  The DNS entry is lower
> case;
>>> the full computer name on the Windows box is lower case.  I don't see
> where
>>> the upper is coming from, unless it's one of those weird
> Windows-to-Unix
>>> translation things.
>>>
>>> Not a big deal, but a bit of an annoyance.  Thanks for any help.
>>>
>>
>> I guess the client is sending the hostname in all caps, you can
> confirm
>> it with tcpdump.
>>
>> You can force lowercase hostnames using the option:
>>
>> normalize-hostnames(yes)
>>
>
> That did it.  Perfect - thanks much!
>
> --
> -- tim --
>
> Tim Boyer
> Denman Tire Corporation
> ________________________________________________________________________
> ______
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>



-- 
Lance Laursen
Demonware Systems Engineer
1-604-689-4594 x3702