[rsyslog] Preserving original hostname?

david at lang.hm david at lang.hm
Tue Feb 7 22:49:18 CET 2012


On Tue, 7 Feb 2012, Rory Toma wrote:

> I am setting up an rsyslog server whose sole purpose is to decompress and 
> unencrypt, then forward the messages on to a centralized syslog server.
>
> I seem to be having trouble getting it to preserve the original message, so 
> that the hostname is from the original sender. I tried using PreserveFQDN, 
> but that doesn't seem to be working, and I can't seem to find an example in 
> the rsyslog docs on how to do this. Is this a simple option, or do I have to 
> set up a template?

if your template uses %hostname% it will preserve what was in the message. 
If you use %fromhost% of %fromhost-ip% it will log the machine the message 
was received from.

my guess is that you use fromhost on your central server.

David Lang



More information about the rsyslog mailing list