[syslog-ng] Insert hostname instead of overwrite ?

[Lance Laursen]

Hmm. Well, if you can't put an intermediary syslog server with use_dns
enabled between your Dell app and the load balancer, I think you're outta
luck. If the log message doesn't contain a hostname, and the sending IP is
that of the load balancer, then syslog really has no way to know where the
message came from. You could write Dell and ask them to conform to RFC
syslog standards but I don't think that's going to happen any time soon :).
The only other thing I can think of is that if you only have one dell
openManage box, you could filter for something specific to those logs then
apply a static hostname using a template. But that method sucks and doesn't
work as soon as you have two openManage boxes forwarding syslogs.


On Thu, Sep 2, 2010 at 3:39 PM, stucky <stucky101 at gmail.com> wrote:

> That's exactly the problem. I cannot keep a hostname that was never written
> in the first place.
> The DELL server administrator doesn't send it. As per my email below it
> sends this :
>
>
> Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242> The
> Patrol Read has started.:  Controller 0 (PERC 5/i Integrated)
>
> So If I do a "keep_hostname" syslog-ng assumes that the server is called
> "Server" which is of course wrong.
>
>
> On Thu, Sep 2, 2010 at 8:21 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:
>
>> On Tue, 2010-08-17 at 18:26 -0700, stucky wrote:
>> > Guys
>> >
>> > I'm trying to log to a loadbalanced VIP. It seems to work ok except
>> > that the loadbalancer uses SNAT so I loose my source IP.
>> > This means I cannot use dns or even the source ip to get the source
>> > host as all logs appear to come from the same source (the
>> > loadbalancer).
>> > This means I have no choice but to rely on the hostname field which
>> > works about 98% of the time but some stuff like Dell OpenManage skips
>> > the hostname field.
>> > So I'd get logs like this on host "cage" f.e.
>> >
>> > Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242
>> > The Patrol Read has started.:  Controller 0 (PERC 5/i Integrated)
>> >
>> > I fixed that by telling the syslog-ng client to force itself to figure
>> > out a proper hostname and now the log looks like this
>> >
>> > Aug 17 13:51:10 cage Administrator[]: Instrumentation Service EventID:
>> > 1000  Server Administrator starting
>> >
>> > I thought syslog-ng inserts the hostname but by the looks of it it
>> > simply replaces whatever is in the expected field with the hostname it
>> > has just figured out.
>> > As you can see it overwrote the entry "Server".
>> > No biggie in the above case but what if this field contained valuable
>> > information ? I'd loose that.
>> > Any way to squeeze in the hostname so to speak ?
>>
>> what about keep_hostname(yes) ?
>>
>>
>> --
>> Bazsi
>>
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
>> http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.campin.net/syslog-ng/faq.html
>>
>>
>
>
> --
> stucky
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>


-- 
Lance Laursen
Demonware Systems Engineer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100902/91c2eeec/attachment.htm