[rsyslog] Preserving original hostname?

Rory Toma rory at ooma.com
Tue Feb 7 22:53:48 CET 2012

On 2/7/12 1:49 PM, david at lang.hm wrote:
> On Tue, 7 Feb 2012, Rory Toma wrote:
>> I am setting up an rsyslog server whose sole purpose is to decompress 
>> and unencrypt, then forward the messages on to a centralized syslog 
>> server.
>> I seem to be having trouble getting it to preserve the original 
>> message, so that the hostname is from the original sender. I tried 
>> using PreserveFQDN, but that doesn't seem to be working, and I can't 
>> seem to find an example in the rsyslog docs on how to do this. Is 
>> this a simple option, or do I have to set up a template?
> if your template uses %hostname% it will preserve what was in the 
> message. If you use %fromhost% of %fromhost-ip% it will log the 
> machine the message was received from.
> my guess is that you use fromhost on your central server.
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
I am currently using no template, or the default template. That must use 
hostname, so I probably have to create my own template... Now I'll have 
to go dig out the instructions for that again, I did that once, a long 
time ago. 8-)


More information about the rsyslog mailing list